Homepage

@openclaw/nostr@2026.2.2

OpenClaw Nostr channel plugin for NIP-04 encrypted direct messages.

  • latest version

    2026.7.1

  • latest non vulnerable version

    2026.8.1-beta.3

  • first published

    6 months ago

  • latest version published

    1 months ago

  • View nostr package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @openclaw/nostr package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Incorrect Authorization

    @openclaw/nostr is an OpenClaw Nostr channel plugin for NIP-04 encrypted DMs

    Affected versions of this package are vulnerable to Incorrect Authorization through the operator.write configuration. An attacker can modify and persist unauthorized profile configurations by sending crafted HTTP requests to affected endpoints without requiring administrative privileges.

    How to fix Incorrect Authorization?

    Upgrade @openclaw/nostr to version 2026.5.2 or higher.

    <2026.5.2
    • M
    Information Exposure

    @openclaw/nostr is an OpenClaw Nostr channel plugin for NIP-04 encrypted DMs

    Affected versions of this package are vulnerable to Information Exposure in the config.get process. An attacker can obtain sensitive plaintext signing keys by accessing configuration views that expose the secret value.

    How to fix Information Exposure?

    Upgrade @openclaw/nostr to version 2026.5.2 or higher.

    <2026.5.2
    • M
    Server-side Request Forgery (SSRF)

    @openclaw/nostr is an OpenClaw Nostr channel plugin for NIP-04 encrypted DMs

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the URL ingestion process. An attacker can access internal or private network resources by crafting a URL containing an ISATAP IPv6 literal that embeds a private IPv4 address, thereby bypassing hostname/IP filtering in URL-fetching paths.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade @openclaw/nostr to version 2026.2.19 or higher.

    <2026.2.19
    • C
    Authentication Bypass Using an Alternate Path or Channel

    @openclaw/nostr is an OpenClaw Nostr channel plugin for NIP-04 encrypted DMs

    Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the Telegram webhook endpoint when webhook mode is enabled without a configured secret. An attacker can impersonate authorized users and execute privileged commands by sending forged HTTP POST requests with spoofed fields in the update payload.

    Note: This is only exploitable if the Telegram webhook is enabled and no webhook secret is configured.

    How to fix Authentication Bypass Using an Alternate Path or Channel?

    Upgrade @openclaw/nostr to version 2026.2.13 or higher.

    <2026.2.13
    Go back to all versions of this package