Security audit

FridayNext — OpenClaw iOS Channel & Node

Security checks across malware telemetry and agentic risk

Overview

The package fits an iPhone OpenClaw channel, but it deserves Review because installation and runtime can broaden gateway access, enable remote app control, and start persistent relay standby with limited user-facing disclosure.

Install only if you want this package to let the FridayNext app operate your OpenClaw gateway from your phone. Before installing, review that it will bind the gateway on LAN, enable canvas/node-related access, add conversation hooks, expose app/admin routes behind bearer authentication, and keep FridayTunnel standby state that contacts SyengUp infrastructure unless explicitly disabled in config.

SkillSpector

By NVIDIA

SkillSpector was not run because this plugin release contains no bundled skills.

VirusTotal

56/56 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/src/public-access/frpc-manager.js:812
Evidence: const c = spawn(frpcPath(), ["-c", confPath], { stdio: "ignore", detached: false });

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: install.js:42
Evidence: execSync(`${cmd} --version`, { stdio: "ignore" });

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/public-access/frpc-manager.ts:942
Evidence: const c = spawn(frpcPath(), ["-c", confPath], { stdio: "ignore", detached: false });

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/src/npm-registry.js:64
Evidence: const override = process.env[REGISTRY_ENV_VAR];

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: install.js:10
Evidence: const sudoUser = process.env.SUDO_USER;

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/npm-registry.ts:67
Evidence: const override = process.env[REGISTRY_ENV_VAR];