registry / @axiomantic/rhizo / 0.2.10

@axiomantic/rhizo@0.2.10

Inter-assistant communication bus, monotonic fencing locks, and work queues over Redis

AI Security Review

scanned 17h ago · by lpm-firewall-ai

The CLI wrapper selects a native executable and runs it. The executable payload could not be assessed as source, so no concrete attack was established.

Static reason

One or more suspicious static signals were detected.

Trigger

Invoking the rhizo CLI or importing its main entry point.

Impact

The native program can perform actions with the caller’s privileges, but its behavior is unresolved from readable source.

Mechanism

The wrapper uses a bundled or cached executable, or downloads a release binary, then starts it with the caller’s arguments and environment.

AI rationale

The inspected JavaScript shows a package-aligned native CLI download and execution path, but does not establish malicious behavior. The unreviewable native payload leaves a real unresolved risk, so this warrants a warning rather than a block.

Evidence

bin/run.jsbin/binaries/rhizo-darwin-arm64bin/binaries/rhizo-darwin-x64bin/binaries/rhizo-linux-arm64bin/binaries/rhizo-linux-x64bin/binaries/rhizo-win32-x64.exe

Network endpoints1

github.com/axiomantic/rhizo/releases

Decision evidence

public snapshot

with false-positive risk.

@axiomantic/rhizo@0.2.10

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code