openclaw-beam

This fragment is not standalone malware; it is a hook-based command execution mechanism that will run a Node.js script at a fixed absolute path when Stop and SessionEnd occur, passing an environment-derived endpoint value to that script. The snippet shows no direct obfuscation or embedded exfiltration indicators, but it creates a potentially dangerous execution path whose safety depends entirely on the integrity and behavior of the referenced `beam` script and how the endpoint argument is handled. Audit the exact `beam` implementation and verify path integrity and endpoint validation.

This snippet is a command-execution lifecycle hook that runs a local Node.js script on Stop and passes an environment-provided BEAM_ENDPOINT into the script. No explicit malicious payloads or secrets are present in the fragment, but the combination of process execution, absolute-path coupling, and unvalidated external input makes the risk depend strongly on the implementation of the invoked `beam` script and the trustworthiness/validation of BEAM_ENDPOINT.