openclaw

Multi-channel AI gateway with extensible messaging integrations

Latest 2026.10.3

NPM

88%

Total Score

healthy

Exceptional release and repository activity outweigh install scripts and limited workflow-audit concerns.

Are you affected? Scan for Free

Health Score Breakdown

Lifecycle scripts

Both preinstall and postinstall scripts run during installation, increasing install-time behavior and review risk compared with a package without lifecycle hooks.

Workflow audit

All analyzed action references are pinned and no untrusted checkout or script-injection paths were found. However, only 30 of 114 workflows were analyzed, and two high-confidence github-app findings plus a low-confidence GITHUB_PATH finding remain.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-57265 openclaw is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.1 - 2026.6.5.	0.0.1 - 2026.6.5	High
CVE-2026-35630 openclaw is vulnerable to Missing Authorization in versions 0.0.0 - 2026.5.18.	0.0.0 - 2026.5.18	High
CVE-2026-53836 openclaw is vulnerable to Incomplete List of Disallowed Inputs in versions 0.0.0 - 2026.5.7.	0.0.0 - 2026.5.7	High
CVE-2026-53834 openclaw is vulnerable to Incorrect Authorization in versions 0.0.0 - 2026.4.26.	0.0.0 - 2026.4.26	High
CVE-2026-53832 openclaw is vulnerable to Improper Privilege Management in versions 0.0.0 - 2026.5.18.	0.0.0 - 2026.5.18	High