ZenMux

PassAudited by VirusTotal on May 10, 2026.

Findings (1)

Package: @zenmux/openclaw-zenmux-provider (npm) Version: 0.2.1 Description: ZenMux LLM provider plugin for OpenClaw — OpenAI-compatible aggregator with 200+ models The package functions as an external plugin for the OpenClaw framework, integrating the ZenMux LLM provider. The code adheres strictly to established OpenClaw plugin patterns for provider registration, authentication, configuration, and dynamic model discovery. Key observations: 1. **Configuration**: It registers the provider ID 'zenmux' and uses `ZENMUX_API_KEY` for authentication. 2. **Network Activity**: The plugin makes authorized HTTP GET requests exclusively to `https://zenmux.ai/api/v1/models` for dynamic model catalog discovery. This activity is explicitly guarded using `fetchWithSsrFGuard` with `allowedHostnames: ['zenmux.ai']`, leveraging OpenClaw's built-in SSRF protection. 3. **Data Handling**: Model capabilities are cached locally using standard Node.js filesystem operations (`node:fs`) within the designated OpenClaw state directory (`resolveStateDir()`), ensuring persistence across sessions without accessing sensitive user files. The logic is clean, follows best practices for plugin development within the target ecosystem, and exhibits no suspicious or malicious behavior.