Sato Check · Package
clodds
npm:clodds · v1.7.7 · sha256:a2f1c21d891b · as of 2026-09-26
- Does it take your key? traced
- Yes — it reads private-key material. Local signing is what a wallet does; question 2 says whether the key leaves.
- Our static read of the published artifact found it.
- Does your key leave? observed
- Not observed — no planted key left during install and start-up, under our test conditions — code paths that only run later, or only on a trigger, are not covered.
- We ran it with planted test keys and saw it.
- Can it move funds on its own? no evidence
- Unknown — we could not read what it exposes.
- No evidence line on file for this question yet.
- What changed? no evidence
- First profile of this subject — nothing to compare yet.
- No evidence line on file for this question yet.
Is this your project? Respond →Dispute this reading
Hosts contacted
| Host | When | Role | Evidence |
|---|---|---|---|
| accounts.google.com | code | other | traced |
| agentbets-api-production.up.railway.app | code | other | traced |
| api-data.line.me | code | other | traced |
| api.1inch.dev | code | other | traced |
| api.acleddata.com | code | other | traced |
| api.anthropic.com | code | other | traced |
| api.avax.network | code | other | traced |
| api.bankr.bot | code | other | traced |
| api.betfair.com | code | other | traced |
| api.binance.com | code | other | traced |
| api.botframework.com | code | other | traced |
| api.clodds.com | code | other | traced |
| api.cohere.ai | code | other | traced |
| api.coinbase.com | code | other | traced |
| api.coingecko.com | code | other | traced |
| api.devnet.solana.com | code | rpc | traced |
| api.elections.kalshi.com | code | other | traced |
| api.elevenlabs.io | code | other | traced |
| api.fireworks.ai | code | other | traced |
| api.github.com | code | registry | traced |
| api.githubcopilot.com | code | other | traced |
| api.goldsky.com | code | other | traced |
| api.gopluslabs.io | code | other | traced |
| api.groq.com | code | other | traced |
| api.hyperliquid.xyz | code | other | traced |
| api.lighter.xyz | code | other | traced |
| api.line.me | code | other | traced |
| api.mainnet-beta.solana.com | code | rpc | traced |
| api.manifold.markets | code | other | traced |
| api.neynar.com | code | other | traced |
| api.nft.storage | code | other | traced |
| api.odos.xyz | code | other | traced |
| api.openai.com | code | other | traced |
| api.opinion.trade | code | other | traced |
| api.predict.fun | code | other | traced |
| api.raydium.io | code | other | traced |
| api.search.brave.com | code | other | traced |
| api.slack.com | code | other | traced |
| api.telegram.org | code | other | traced |
| api.together.xyz | code | other | traced |
| api.twilio.com | code | other | traced |
| api.virtuals.io | code | other | traced |
| api.weather.gov | code | other | traced |
| apidocs.acleddata.com | code | other | traced |
| app.virtuals.io | code | other | traced |
| arb1.arbitrum.io | code | other | traced |
| arbiscan.io | code | other | traced |
| auth.openai.com | code | other | traced |
| basescan.org | code | other | traced |
| bet.drift.trade | code | other | traced |
| bsc-dataseed.binance.org | code | other | traced |
| bsc-dataseed1.binance.org | code | other | traced |
| bscscan.com | code | other | traced |
| cdn.jsdelivr.net | code | other | traced |
| chat.zalo.me | code | other | traced |
| clob.polymarket.com | code | other | traced |
| cloddhub.com | code | other | traced |
| clodds.com | code | other | traced |
| cloddsbot.com | code | vendor | traced |
| composio.dev | code | other | traced |
| registry.npmjs.org | install | registry | observed |
| github.com | install | registry | observed |
Evidence (79 lines)
- observedO-hosts2026-09-25
registry.npmjs.org was contacted during install (registry).
sandbox:obs_8fe193d4fab57c0f
- observedO-hosts2026-09-25
github.com was contacted during install (registry).
sandbox:obs_8fe193d4fab57c0f
- tracedT-install-script2026-09-26
package.json runs postinstall: node -e "try{const{pipeline,env}=require('@xenova/transformers');env.cacheDir='./.transformers-cache';pipeline('feature-extraction','Xenova/all-MiniLM-L6-v2',{quantized:true}).then(()=>console.log('Embedding model cached')).catch(()=>{})}catch{}".
package.json
- tracedT-key-read2026-09-26
Reads process.env.OPINION_PRIVATE_KEY.
dist/agents/index.js:12332
- tracedT-key-read2026-09-26
Reads process.env.OPINION_PRIVATE_KEY.
dist/agents/index.js:12377
- tracedT-key-read2026-09-26
Reads process.env.OPINION_PRIVATE_KEY.
dist/agents/index.js:12407
- tracedT-key-read2026-09-26
Reads process.env.OPINION_PRIVATE_KEY.
dist/agents/index.js:12423
- tracedT-key-read2026-09-26
Reads process.env.OPINION_PRIVATE_KEY.
dist/agents/index.js:12440
- tracedT-key-read2026-09-26
Reads process.env.OPINION_PRIVATE_KEY.
dist/agents/index.js:12457
- tracedT-key-read2026-09-26
Reads process.env.OPINION_PRIVATE_KEY.
dist/agents/index.js:12473
- tracedT-key-read2026-09-26
Reads process.env.OPINION_PRIVATE_KEY.
dist/agents/index.js:12490
- tracedT-hosts2026-09-26
accounts.google.com appears in shipped code (other).
dist/auth/google.js
- tracedT-hosts2026-09-26
agentbets-api-production.up.railway.app appears in shipped code (other).
dist/agents/handlers/agentbets.js
- tracedT-hosts2026-09-26
api-data.line.me appears in shipped code (other).
dist/channels/line/index.js
- tracedT-hosts2026-09-26
api.1inch.dev appears in shipped code (other).
dist/evm/oneinch.js
- tracedT-hosts2026-09-26
api.acleddata.com appears in shipped code (other).
dist/feeds/acled/index.js
- tracedT-hosts2026-09-26
api.anthropic.com appears in shipped code (other).
dist/auth/oauth.js
- tracedT-hosts2026-09-26
api.avax.network appears in shipped code (other).
dist/evm/multichain.js
- tracedT-hosts2026-09-26
api.bankr.bot appears in shipped code (other).
dist/bankr/client.js
- tracedT-hosts2026-09-26
api.betfair.com appears in shipped code (other).
dist/feeds/betfair/index.js
- tracedT-hosts2026-09-26
api.binance.com appears in shipped code (other).
dist/api/compute/data.js
- tracedT-hosts2026-09-26
api.botframework.com appears in shipped code (other).
dist/channels/teams/index.js
- tracedT-hosts2026-09-26
api.clodds.com appears in shipped code (other).
dist/api/sdk.js
- tracedT-hosts2026-09-26
api.cohere.ai appears in shipped code (other).
dist/extensions/memory-lancedb/index.js
- tracedT-hosts2026-09-26
api.coinbase.com appears in shipped code (other).
dist/feeds/crypto/index.js
- tracedT-hosts2026-09-26
api.coingecko.com appears in shipped code (other).
dist/agents/index.js
- tracedT-hosts2026-09-26
api.devnet.solana.com appears in shipped code (rpc).
dist/percolator/types.js
- tracedT-hosts2026-09-26
api.elections.kalshi.com appears in shipped code (other).
dist/agents/index.js
- tracedT-hosts2026-09-26
api.elevenlabs.io appears in shipped code (other).
dist/tts/index.js
- tracedT-hosts2026-09-26
api.fireworks.ai appears in shipped code (other).
dist/providers/discovery.js
- tracedT-hosts2026-09-26
api.github.com appears in shipped code (registry).
dist/auth/copilot.js
- tracedT-hosts2026-09-26
api.githubcopilot.com appears in shipped code (other).
dist/auth/copilot.js
- tracedT-hosts2026-09-26
api.goldsky.com appears in shipped code (other).
dist/api/compute/data.js
- tracedT-hosts2026-09-26
api.gopluslabs.io appears in shipped code (other).
dist/token-security/index.js
- tracedT-hosts2026-09-26
api.groq.com appears in shipped code (other).
dist/providers/discovery.js
- tracedT-hosts2026-09-26
api.hyperliquid.xyz appears in shipped code (other).
dist/exchanges/hyperliquid/index.js
- tracedT-hosts2026-09-26
api.lighter.xyz appears in shipped code (other).
dist/exchanges/lighter/index.js
- tracedT-hosts2026-09-26
api.line.me appears in shipped code (other).
dist/channels/line/index.js
- tracedT-hosts2026-09-26
api.mainnet-beta.solana.com appears in shipped code (rpc).
dist/ledger/anchor.js
- tracedT-hosts2026-09-26
api.manifold.markets appears in shipped code (other).
dist/agents/index.js
- tracedT-hosts2026-09-26
api.neynar.com appears in shipped code (other).
dist/farcaster/client.js
- tracedT-hosts2026-09-26
api.nft.storage appears in shipped code (other).
dist/gateway/launch-routes.js
- tracedT-hosts2026-09-26
api.odos.xyz appears in shipped code (other).
dist/evm/odos.js
- tracedT-hosts2026-09-26
api.openai.com appears in shipped code (other).
dist/auth/oauth.js
- tracedT-hosts2026-09-26
api.opinion.trade appears in shipped code (other).
dist/agents/index.js
- tracedT-hosts2026-09-26
api.predict.fun appears in shipped code (other).
dist/agents/handlers/predictfun.js
- tracedT-hosts2026-09-26
api.raydium.io appears in shipped code (other).
dist/solana/raydium.js
- tracedT-hosts2026-09-26
api.search.brave.com appears in shipped code (other).
dist/tools/web-search.js
- tracedT-hosts2026-09-26
api.slack.com appears in shipped code (other).
dist/gateway/server.js
- tracedT-hosts2026-09-26
api.telegram.org appears in shipped code (other).
dist/channels/telegram/index.js
- tracedT-hosts2026-09-26
api.together.xyz appears in shipped code (other).
dist/providers/discovery.js
- tracedT-hosts2026-09-26
api.twilio.com appears in shipped code (other).
dist/tools/sms.js
- tracedT-hosts2026-09-26
api.virtuals.io appears in shipped code (other).
dist/evm/virtuals.js
- tracedT-hosts2026-09-26
api.weather.gov appears in shipped code (other).
dist/weather/noaa.js
- tracedT-hosts2026-09-26
apidocs.acleddata.com appears in shipped code (other).
dist/feeds/descriptors.js
- tracedT-hosts2026-09-26
app.virtuals.io appears in shipped code (other).
dist/commands/registry.js
- tracedT-hosts2026-09-26
arb1.arbitrum.io appears in shipped code (other).
dist/evm/multichain.js
- tracedT-hosts2026-09-26
arbiscan.io appears in shipped code (other).
dist/evm/multichain.js
- tracedT-hosts2026-09-26
auth.openai.com appears in shipped code (other).
dist/auth/oauth.js
- tracedT-hosts2026-09-26
basescan.org appears in shipped code (other).
dist/evm/multichain.js
- tracedT-hosts2026-09-26
bet.drift.trade appears in shipped code (other).
dist/agents/index.js
- tracedT-hosts2026-09-26
bsc-dataseed.binance.org appears in shipped code (other).
dist/evm/multichain.js
- tracedT-hosts2026-09-26
bsc-dataseed1.binance.org appears in shipped code (other).
dist/evm/pancakeswap.js
- tracedT-hosts2026-09-26
bscscan.com appears in shipped code (other).
dist/evm/multichain.js
- tracedT-hosts2026-09-26
cdn.jsdelivr.net appears in shipped code (other).
dist/gateway/server.js
- tracedT-hosts2026-09-26
chat.zalo.me appears in shipped code (other).
dist/channels/zalo/index.js
- tracedT-hosts2026-09-26
clob.polymarket.com appears in shipped code (other).
dist/agents/index.js
- tracedT-hosts2026-09-26
cloddhub.com appears in shipped code (other).
dist/skills/registry.js
- tracedT-hosts2026-09-26
clodds.com appears in shipped code (other).
dist/link-understanding/index.js
- tracedT-hosts2026-09-26
cloddsbot.com appears in shipped code (vendor).
dist/gateway/server.js
- tracedT-hosts2026-09-26
composio.dev appears in shipped code (other).
dist/skills/executor.js
- tracedT-key-named2026-09-26
The shipped code names OPINION_PRIVATE_KEY in a message to the user.
dist/agents/index.js
- tracedT-key-named2026-09-26
The shipped code names EVM_PRIVATE_KEY in a message to the user.
dist/bridge/wormhole.js
- tracedT-key-named2026-09-26
The shipped code names SOLANA_PRIVATE_KEY in a message to the user.
dist/agents/index.js
- tracedT-key-named2026-09-26
The shipped code names SOLANA_KEYPAIR_PATH in a message to the user.
dist/agents/index.js
- tracedT-key-named2026-09-26
The shipped code names HYPERLIQUID_PRIVATE_KEY in a message to the user.
dist/gateway/server.js
- tracedT-key-named2026-09-26
The shipped code names PREDICTFUN_PRIVATE_KEY in a message to the user.
dist/feeds/descriptors.js
- tracedT-key-named2026-09-26
The shipped code names POLY_PRIVATE_KEY in a message to the user.
dist/feeds/descriptors.js
- declaredD-env-key2026-09-26
Setup names SOLANA_PRIVATE_KEY as something to provide.
clodds@1.7.7/README.md
Limits
- Traced analysis follows flows inside one module only; a key handed from one module to another is not followed.
- Key egress not observed during install and start-up, under our test conditions — code paths that only run later, or only on a trigger, are not covered.
- No tool inventory was available, so fund actions were not read.
- Sandbox: DNS queries made directly by the target are not logged; hosts are recorded from proxied HTTP(S) requests and CONNECTs..
- Sandbox: Code that ignores HTTP(S)_PROXY has no route out of the sandbox, so its attempts are not captured..
- Traced: 595 code files; parsed 400, entry points first; 156 literal hosts; listed the first 60; 39 key reads; the first 8 are listed.
A profile describes what we read and ran, with dates. It is not a safety rating, an audit or an endorsement, and "not found" is not "not there".
sato.custody/v1 · custody-1
Maintain this project? Respond to this reading
Loading sign-in…