
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
@peac/adapter-openclaw
Advanced tools
OpenClaw adapter for capturing agent tool calls as signed, offline-verifiable PEAC interaction records.
pnpm add @peac/adapter-openclaw
@peac/adapter-openclaw captures every tool call an OpenClaw agent makes and produces tamper-evident signed receipts. It uses a two-stage pipeline: a sync capture stage (under 10ms) appends hashed evidence to an append-only spool, and an async background emitter drains the spool, signs each entry, and writes individual receipt files. All inputs and outputs are SHA-256 hashed by default; plaintext is only captured for explicitly allowlisted tools.
import { activate, generateSigningKey } from '@peac/adapter-openclaw';
// Generate a signing key (one-time setup)
const key = await generateSigningKey({ outputDir: '.peac' });
// Activate the plugin
const plugin = await activate({
config: {
signing: {
key_ref: `file:${key.keyPath}`,
issuer: 'https://my-org.example.com',
},
},
});
plugin.instance.start();
// Records are now captured automatically via hooks.
import { mapToolCallEvent } from '@peac/adapter-openclaw';
const result = mapToolCallEvent(event);
if (result.ok) {
console.log('Captured action:', result.action);
console.log('Warnings:', result.warnings);
}
import {
createHookHandler,
createReceiptEmitter,
createBackgroundService,
createSessionHistoryTailer,
} from '@peac/adapter-openclaw';
@peac/adapter-core (Layer 4): Shared Result types@peac/capture-core: Capture session, spool store, and deduplication@peac/capture-node: File-system spool store and deduplication index@peac/crypto (Layer 2): Ed25519 signing and SHA-256 hashing@peac/kernel (Layer 0): Wire constants and types@peac/schema (Layer 1): Receipt claim schemasIf you are building an AI agent on OpenClaw that needs verifiable activity records:
activate() for the simplest setup; it wires all components from a single config objectgenerateSigningKey() or the peac-keygen CLI to create a signing keypairenv: key references in CI/CD and file: references for local developmentpeac_receipts.status, peac_receipts.verify, peac_receipts.query, peac_receipts.export_bundle) for the agent to inspect its own receipt stateApache-2.0
PEAC Protocol is an open source project stewarded by Originary and community contributors.
FAQs
OpenClaw adapter for PEAC interaction evidence capture
We found that @peac/adapter-openclaw demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.