openclaw

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Behind the package

View on npm

Explore what the publisher declares for the latest npm release. These details are not a safety score; listed attestations have not been independently verified here.

Multi-channel AI gateway with extensible messaging integrations

Latest release2026.10.9

Declared licenseMIT

Listed maintainerssteipete, vincentkoc

Runtime dependencies66

Install-time scriptspreinstall, postinstall

Integrity metadataRecorded by registry

Attestation metadataRecorded, not verified here

Registry deprecationNot marked deprecated

Direct dependencies of 2026.10.9

ws8.22.0
npm12.2.0
tar7.5.22
zod4.6.5
diff9.0.0
jiti2.7.0
yaml2.9.1
acorn8.18.0
chalk6.0.1
execa10.0.1
json52.2.3
jszip3.10.2
koffi3.3.2
p-map7.0.8
tslog5.2.0
croner10.0.1
dotenv18.0.5
grammy1.46.0
ignore7.0.12
kysely0.29.6
openai7.27.0
qrcode1.5.4
semver7.8.5
undici8.11.2
clawpdf0.3.2
esbuild0.28.2
express5.2.1
p-limit7.3.3
typebox1.3.34
entities8.1.0
linkedom0.18.13
web-push3.6.7
commander15.0.0
file-type22.1.1
minimatch10.2.6
iconv-lite0.7.3
rastermill0.4.0
@clack/core1.5.1
htmlparser212.0.0
@openclaw/ai2026.10.9
highlight.js11.12.0
partial-json0.1.7
@babel/parser8.0.6
@google/genai2.27.0
node-edge-tts1.2.10
@clack/prompts1.8.1
@babel/traverse8.0.6
hosted-git-info10.1.1
playwright-core1.63.0
web-tree-sitter0.27.0
@babel/generator8.0.6
@homebridge/ciao1.3.12
@lydell/node-pty1.2.0-beta.15
@anthropic-ai/sdk0.131.0
@openclaw/fs-safe0.26.0
@trycua/cua-driver0.32.0
@openclaw/proxyline0.4.0
chrome-devtools-mcp1.10.1
import-meta-resolve4.2.0
@mistralai/mistralai2.7.0
@mozilla/readability0.6.0
@earendil-works/pi-tui1.0.0
@agentclientprotocol/sdk1.7.0
@modelcontextprotocol/sdk1.32.0
@silvia-odwyer/photon-node0.3.4
@grammyjs/transformer-throttler1.2.1

Fetched 31/10/2026, 00:42:15 UTC · Original registry metadata

Release history

Explore up to 40 recent releases. Pick a version for an OSV check; registry metadata alone does not tell you whether a release has known vulnerabilities.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

high7.1

CVE-2026-35632

OpenClaw < 2026.3.24 - Symlink Traversal via IDENTITY.md appendFile in agents.create/update

OpenClaw · OpenClaw

7 months ago

high7.1

CVE-2026-40037

OpenClaw < 2026.4.8 - Unsafe Request Body Replay via fetchWithSsrFGuard Cross-Origin Redirects

OpenClaw · OpenClaw

7 months ago