Clawndom: A Security Hook for Claude Code to Block Vulnerable npm Packages

A developer has released Clawndom, an open-source security tool for Claude Code that addresses concerns about AI agents installing vulnerable npm packages. The tool was created in response to security incidents like the axios attack, which highlighted risks including malware installation, unauthorized API key usage, shipping compromised code, and reputation damage.

How Clawndom Works

Clawndom implements a hook in Claude Code that connects to OSV.dev, a Google-backed open-source vulnerability database. When an agent attempts to install a package, the hook automatically checks it against OSV's database. Clean packages pass through silently, while vulnerable packages trigger an alert where the agent is told why the package is unsafe and prompted to select a safer version.

Key Implementation Details

• The hook runs server-side against OSV.dev, preventing agents from hallucinating their way past vulnerabilities
• Token costs are negligible since it runs as a hook rather than a tool call
• The approach blocks thousands of known-bad packages on npm, though it won't catch zero-day attacks
• Maintains agent autonomy without requiring developers to babysit every install or disable permission-skipping features

Background Context

The developer notes that npm rarely removes packages with known vulnerabilities, leaving them installable despite security issues. This creates particular risks with AI agents that might install packages without proper vetting. The tool addresses the tension between security concerns and maintaining the autonomous functionality that makes agents valuable.

Availability

The complete code is available on GitHub at https://github.com/reid1b/Clawndom. Developers can copy the implementation directly or ask their agents to examine and implement it.