@termix-it/cryptoclaw
npm:@termix-it/cryptoclaw · v1.1.13 · sha256:4334921bb412 · as of 2026-10-15
- Does it take your key? no evidence
- Unknown — we could not read this version.
- No evidence line on file for this question yet.
- Does your key leave? observed
- Not observed — no planted key left during install and start-up, under our test conditions — code paths that only run later, or only on a trigger, are not covered.
- We ran it with planted test keys and saw it.
- Can it move funds on its own? no evidence
- Unknown — we could not read what it exposes.
- No evidence line on file for this question yet.
- What changed? observed
- No change in key, host or fund behaviour since the previous version.
- We ran it with planted test keys and saw it.
Is this your project? Respond →Dispute this reading
Hosts contacted
| Host | When | Role | Evidence |
|---|---|---|---|
| api.chutes.ai | code | other | traced |
| api.deepgram.com | code | other | traced |
| api.github.com | code | registry | traced |
| api.groq.com | code | other | traced |
| api.individual.githubcopilot.com | code | other | traced |
| api.kilo.ai | code | other | traced |
| api.kimi.com | code | other | traced |
| api.minimax.io | code | other | traced |
| api.minimaxi.com | code | other | traced |
| api.mistral.ai | code | other | traced |
| api.moonshot.ai | code | other | traced |
| api.moonshot.cn | code | other | traced |
| api.openai.com | code | other | traced |
| api.synthetic.new | code | other | traced |
| api.telegram.org | code | other | traced |
| api.together.xyz | code | other | traced |
| api.venice.ai | code | other | traced |
| api.voyageai.com | code | other | traced |
| api.x.ai | code | other | traced |
| api.xiaomimimo.com | code | other | traced |
| api.z.ai | code | other | traced |
| ark.ap-southeast.bytepluses.com | code | other | traced |
| ark.cn-beijing.volces.com | code | other | traced |
| brave.com | code | other | traced |
| brew.sh | code | other | traced |
| bun.sh | code | other | traced |
| chat.qwen.ai | code | other | traced |
| chutes.ai | code | other | traced |
| console.bce.baidu.com | code | other | traced |
| control.example.com | code | other | traced |
| discord.com | code | other | traced |
| docs.openclaw.ai | code | other | traced |
| fonts.googleapis.com | code | other | traced |
| fonts.gstatic.com | code | other | traced |
| gateway.ai.cloudflare.com | code | other | traced |
| generativelanguage.googleapis.com | code | other | traced |
| huggingface.co | code | other | traced |
| integrate.api.nvidia.com | code | other | traced |
| litellm.ai | code | other | traced |
| open.bigmodel.cn | code | other | traced |
| openclaw.ai | code | other | traced |
| opencode.ai | code | other | traced |
| openrouter.ai | code | other | traced |
| portal.qwen.ai | code | other | traced |
| qianfan.baidubce.com | code | other | traced |
| registry.npmjs.org | code | registry | traced |
| router.huggingface.co | code | other | traced |
| t.me | code | other | traced |
| tailscale.com | code | other | traced |
| venice.ai | code | other | traced |
| www.apple.com | code | other | traced |
| www.kimi.com | code | other | traced |
| www.perplexity.ai | code | other | traced |
| registry.npmjs.org | install | registry | observed |
| github.com | install | registry | observed |
Evidence (55 lines)
- observedO-hosts2026-10-15
registry.npmjs.org was contacted during install (registry).
sandbox:obs_507bd31db5a7068a
- observedO-hosts2026-10-15
github.com was contacted during install (registry).
sandbox:obs_507bd31db5a7068a
- tracedT-hosts2026-10-15
api.chutes.ai appears in shipped code (other).
dist/plugin-sdk/discord.js
- tracedT-hosts2026-10-15
api.deepgram.com appears in shipped code (other).
dist/audio-transcription-runner-CFk6mxWm.js
- tracedT-hosts2026-10-15
api.github.com appears in shipped code (registry).
dist/plugin-sdk/index.js
- tracedT-hosts2026-10-15
api.groq.com appears in shipped code (other).
dist/audio-transcription-runner-CFk6mxWm.js
- tracedT-hosts2026-10-15
api.individual.githubcopilot.com appears in shipped code (other).
dist/github-copilot-token-CnC3S-yo.js
- tracedT-hosts2026-10-15
api.kilo.ai appears in shipped code (other).
dist/auth-profiles-C-7bMPJR.js
- tracedT-hosts2026-10-15
api.kimi.com appears in shipped code (other).
dist/auth-profiles-C-7bMPJR.js
- tracedT-hosts2026-10-15
api.minimax.io appears in shipped code (other).
dist/auth-profiles-C-7bMPJR.js
- tracedT-hosts2026-10-15
api.minimaxi.com appears in shipped code (other).
dist/auth-token-BjFeC1r8.js
- tracedT-hosts2026-10-15
api.mistral.ai appears in shipped code (other).
dist/audio-transcription-runner-CFk6mxWm.js
- tracedT-hosts2026-10-15
api.moonshot.ai appears in shipped code (other).
dist/audio-transcription-runner-CFk6mxWm.js
- tracedT-hosts2026-10-15
api.moonshot.cn appears in shipped code (other).
dist/auth-token-BjFeC1r8.js
- tracedT-hosts2026-10-15
api.openai.com appears in shipped code (other).
dist/audio-transcription-runner-CFk6mxWm.js
- tracedT-hosts2026-10-15
api.synthetic.new appears in shipped code (other).
dist/auth-profiles-C-7bMPJR.js
- tracedT-hosts2026-10-15
api.telegram.org appears in shipped code (other).
dist/plugin-sdk/index.js
- tracedT-hosts2026-10-15
api.together.xyz appears in shipped code (other).
dist/auth-choice-DvVltDEY.js
- tracedT-hosts2026-10-15
api.venice.ai appears in shipped code (other).
dist/auth-profiles-C-7bMPJR.js
- tracedT-hosts2026-10-15
api.voyageai.com appears in shipped code (other).
dist/manager-BLaGOY-x.js
- tracedT-hosts2026-10-15
api.x.ai appears in shipped code (other).
dist/auth-token-BjFeC1r8.js
- tracedT-hosts2026-10-15
api.xiaomimimo.com appears in shipped code (other).
dist/auth-profiles-C-7bMPJR.js
- tracedT-hosts2026-10-15
api.z.ai appears in shipped code (other).
dist/auth-token-BjFeC1r8.js
- tracedT-hosts2026-10-15
ark.ap-southeast.bytepluses.com appears in shipped code (other).
dist/auth-profiles-C-7bMPJR.js
- tracedT-hosts2026-10-15
ark.cn-beijing.volces.com appears in shipped code (other).
dist/auth-profiles-C-7bMPJR.js
- tracedT-hosts2026-10-15
brave.com appears in shipped code (other).
dist/configure-CSTy57Bm.js
- tracedT-hosts2026-10-15
brew.sh appears in shipped code (other).
dist/plugin-sdk/index.js
- tracedT-hosts2026-10-15
bun.sh appears in shipped code (other).
dist/daemon-cli.js
- tracedT-hosts2026-10-15
chat.qwen.ai appears in shipped code (other).
dist/auth-profiles-C-7bMPJR.js
- tracedT-hosts2026-10-15
chutes.ai appears in shipped code (other).
dist/auth-choice-DvVltDEY.js
- tracedT-hosts2026-10-15
console.bce.baidu.com appears in shipped code (other).
dist/auth-choice-DvVltDEY.js
- tracedT-hosts2026-10-15
control.example.com appears in shipped code (other).
dist/audit-J-h_bTvq.js
- tracedT-hosts2026-10-15
discord.com appears in shipped code (other).
dist/plugin-sdk/discord.js
- tracedT-hosts2026-10-15
docs.openclaw.ai appears in shipped code (other).
dist/plugin-sdk/discord.js
- tracedT-hosts2026-10-15
fonts.googleapis.com appears in shipped code (other).
dist/gateway-cli-6804nEns.js
- tracedT-hosts2026-10-15
fonts.gstatic.com appears in shipped code (other).
dist/gateway-cli-6804nEns.js
- tracedT-hosts2026-10-15
gateway.ai.cloudflare.com appears in shipped code (other).
dist/auth-profiles-C-7bMPJR.js
- tracedT-hosts2026-10-15
generativelanguage.googleapis.com appears in shipped code (other).
dist/audio-transcription-runner-CFk6mxWm.js
- tracedT-hosts2026-10-15
huggingface.co appears in shipped code (other).
dist/auth-choice-DvVltDEY.js
- tracedT-hosts2026-10-15
integrate.api.nvidia.com appears in shipped code (other).
dist/auth-profiles-C-7bMPJR.js
- tracedT-hosts2026-10-15
litellm.ai appears in shipped code (other).
dist/auth-choice-DvVltDEY.js
- tracedT-hosts2026-10-15
open.bigmodel.cn appears in shipped code (other).
dist/auth-token-BjFeC1r8.js
- tracedT-hosts2026-10-15
openclaw.ai appears in shipped code (other).
dist/plugin-sdk/discord.js
- tracedT-hosts2026-10-15
opencode.ai appears in shipped code (other).
dist/auth-choice-DvVltDEY.js
- tracedT-hosts2026-10-15
openrouter.ai appears in shipped code (other).
dist/auth-profiles-C-7bMPJR.js
- tracedT-hosts2026-10-15
portal.qwen.ai appears in shipped code (other).
dist/auth-profiles-C-7bMPJR.js
- tracedT-hosts2026-10-15
qianfan.baidubce.com appears in shipped code (other).
dist/auth-profiles-C-7bMPJR.js
- tracedT-hosts2026-10-15
registry.npmjs.org appears in shipped code (registry).
dist/channel-account-context-2ooi5Tir.js
- tracedT-hosts2026-10-15
router.huggingface.co appears in shipped code (other).
dist/auth-profiles-C-7bMPJR.js
- tracedT-hosts2026-10-15
t.me appears in shipped code (other).
dist/gateway-cli-6804nEns.js
- tracedT-hosts2026-10-15
tailscale.com appears in shipped code (other).
dist/ipv4-CLhg5DXF.js
- tracedT-hosts2026-10-15
venice.ai appears in shipped code (other).
dist/auth-choice-DvVltDEY.js
- tracedT-hosts2026-10-15
www.apple.com appears in shipped code (other).
dist/daemon-cli.js
- tracedT-hosts2026-10-15
www.kimi.com appears in shipped code (other).
dist/auth-choice-DvVltDEY.js
- tracedT-hosts2026-10-15
www.perplexity.ai appears in shipped code (other).
dist/configure-CSTy57Bm.js
Limits
- Traced analysis follows flows inside one module and one hop across a relative import; a longer chain is not followed.
- Key access stays unknown: most of its shipped JavaScript by size is in files over 2 MB, which are not read, so "no key read found" is not reported.
- Key egress not observed during install and start-up, under our test conditions — code paths that only run later, or only on a trigger, are not covered.
- No tool inventory was available, so fund actions were not read.
- Sandbox: DNS queries made directly by the target are not logged; hosts are recorded from proxied HTTP(S) requests and CONNECTs..
- Sandbox: Code that ignores HTTP(S)_PROXY has no route out of the sandbox, so its attempts are not captured..
- Traced: read selectively — the tarball is 27991591 bytes, over the 15728640-byte whole-read size, so only package.json, the README and shipped JavaScript up to 2.0 MB a file were unpacked (1070 code files, 27.3 MB); not read: 1142 other files (18.4 MB), 791 TypeScript sources (4.3 MB), 1797 type declarations (2.8 MB), 5 source maps (1.8 MB), 2 test and minified JavaScript (0.2 MB); 7 JavaScript files over 2.0 MB not read (28.9 MB; largest: extensions/diffs/assets/viewer-runtime.js, dist/plugin-sdk/reply-CuLaAAkb.js, dist/pi-embedded-Dwlk3Sob.js); 1070 code files; parsed 400, entry points first.
A profile describes what we read and ran, with dates. It is not a safety rating, an audit or an endorsement, and "not found" is not "not there".
sato.custody/v1 · custody-3
Maintain this project? Respond to this reading
Loading sign-in…