Latest release: v2026.9.2Download zip
Compatibility
Security Scan
OpenClaw
Benign
high confidenceCredentials
It uses Matrix homeserver credentials from config, environment variables, or OpenClaw secret inputs, connects to configured Matrix homeservers/proxies, and includes SSRF/private-network controls; this is proportionate for a Matrix integration.
Install Mechanism
The package has no npm lifecycle scripts; it installs as an OpenClaw/npm plugin with Matrix SDK dependencies. It can run a fixed Matrix crypto dependency bootstrap command if the native crypto runtime is missing.
Instruction Scope
Runtime actions are exposed through the Matrix channel and CLI, with action gates, sender allowlists, group/DM policies, mention checks, and owner-only checks for profile and verification operations.
Persistence & Privilege
It persists Matrix access tokens, device IDs, sync cache, crypto state, recovery-key state, inbound dedupe data, and thread bindings in OpenClaw plugin state; this is expected for logged-in Matrix operation but should be treated as sensitive.
Purpose & Capability
The package is a Matrix channel plugin for rooms and direct messages; it can receive Matrix messages, send replies, upload media, edit/delete/pin messages, manage profile state, and handle verification, which fits the stated purpose.
Assessment
Install only if you intend to let OpenClaw act as a Matrix bot. Use a dedicated Matrix account with limited room membership, restrict DM/group allowlists, avoid autoJoin="always" unless you understand the exposure, and protect OpenClaw state because it may contain Matrix access tokens and encryption state.node_modules/matrix-js-sdk/lib/crypto-api/index.d.ts:1083
File appears to expose a hardcoded API secret or token.
node_modules/matrix-js-sdk/lib/crypto-api/index.js.map:1
File appears to expose a hardcoded API secret or token.
node_modules/matrix-js-sdk/lib/embedded.js.map:1
File appears to expose a hardcoded API secret or token.
node_modules/matrix-js-sdk/lib/http-api/fetch.js.map:1
File appears to expose a hardcoded API secret or token.
node_modules/matrix-js-sdk/lib/interactive-auth.d.ts:44
File appears to expose a hardcoded API secret or token.
node_modules/matrix-js-sdk/lib/oauth/tokenRefresher.js.map:1
File appears to expose a hardcoded API secret or token.
node_modules/matrix-js-sdk/src/crypto-api/index.ts:1265
File appears to expose a hardcoded API secret or token.
node_modules/matrix-js-sdk/src/interactive-auth.ts:75
File appears to expose a hardcoded API secret or token.
node_modules/matrix-js-sdk/node_modules/another-json/spec/another-json-spec.js:43
Potential obfuscated payload detected.
node_modules/matrix-js-sdk/node_modules/sdp-transform/lib/grammar.js:272
Potential obfuscated payload detected.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Verification
Tags
OpenClaw Matrix
Official OpenClaw channel plugin for Matrix rooms and direct messages.
Install from OpenClaw:
openclaw plugins install @openclaw/matrix
Configure the Matrix homeserver and bot credentials in OpenClaw. The plugin lets agents join configured rooms, receive messages, and reply through Matrix.