@baize-ai/core@0.3.14

Baize (白泽) — autonomous AI agent infrastructure

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The source establishes an automatic lifecycle configuration change affecting AI-agent controls, but not a concrete malicious chain. It warrants a warning under the first-party agent extension lifecycle policy.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing or upgrading the package after a Baize workspace has been initialized.

Impact

Future Claude or Codex sessions in the Baize project can execute package-managed session-start hooks; global Codex configuration is modified.

Mechanism

Lifecycle-driven AI-agent hook and configuration synchronization.

AI rationale

Evidence

package.jsonscripts/postinstall.jscli/lib/sync-settings-hooks.jscli/lib/runtime-setup.jscli/lib/codex-hooks.js~/baize/.claude/settings.json~/baize/.codex/config.toml~/.codex/config.toml~/baize/.codex/hooks.json

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Installation automatically runs a postinstall script.
When a Baize workspace already exists, postinstall invokes settings and Codex configuration synchronization.
The synchronization writes global Codex configuration and installs session-start hooks for the Baize project.

Evidence against

Postinstall exits unless the package's Baize workspace already contains .claude.
The hooks are scoped to the Baize project and preserve non-core hooks.
No runtime self-dependency or credential exfiltration was found in the inspected lifecycle path.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

30 flagged

package.jsonView file

Lines 1-31json

2 "name": "@baize-ai/core",

3 "version": "0.3.14",

4 "type": "module",

5 "description": "Baize (\u767d\u6cfd) \u2014 autonomous AI agent infrastructure",

6 "main": "cli/baize.js",

7 "bin": {

8 "baize": "./cli/baize.js"

9 },

10 "scripts": {

11 "postinstall": "node scripts/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "pretest": "node scripts/install-skill-deps.js",

13 "test": "npm run test:jest && npm run test:node",

14 "test:jest": "node --experimental-vm-modules node_modules/.bin/jest",

15 "test:node": "node scripts/run-node-tests.js"

16 },

17 "repository": {

18 "type": "git",

19 "url": "https://github.com/baize-ai/baize-core.git"

20 },

21 "keywords": [

22 "ai",

23 "agent",

24 "claude",

25 "autonomous"

26 ],

27 "author": "Baize AI",

28 "license": "MIT",

29 "engines": {

30 "node": ">=20.20.0"

31 },

cli/lib/sync-settings-hooks.jsView file

21import os from 'os'; L22: import { execFileSync } from 'child_process'; L23: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

cli/lib/sync-settings-hooks.jsView on unpkg · L21

cli/commands/init.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. cli/commands/init.js: isValidBaseUrl, saveClaudeBaseUrl, [redacted], saveCodexBaseUrl, saveCodexBaseUrlToEnv, fs.writeFileSync(envPath, content); fs.writeFileSync(envPath, content); * Save an Anthropic API key to ~/.claude/settings.json and process.env.

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

cli/commands/init.jsView on unpkg

9import fs from 'node:fs'; L10: import https from 'node:https'; L11: import os from 'node:os'; ... L13: import { createRequire } from 'node:module'; L14: import { execSync, execFileSync, spawnSync, spawn } from 'node:child_process'; L15: import { BAIZE_DIR, SKILLS_DIR, CONFIG_DIR, COMPONENTS_DIR, LOCKS_DIR, COMPONENTS_FILE, BIN_DIR, HTTP_DIR, CADDYFILE, CADDY_BIN, getBaizeConfig, updateBaizeConfig } from '../lib/co... ... L83: function installSystemPackage(pkg) { L84: const platform = process.platform; L85: const sudo = process.getuid?.() === 0 ? '' : 'sudo '; ... L120: function ensureLocalBinInProfile() { L121: const homedir = os.homedir(); L122: const shell = (process.env.SHELL || '').split('/').pop();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/commands/init.jsView on unpkg · L9

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ); } function verifysetuptoken() { try { const result = spawnsync('claude', ['-p', 'hi', '--max-turns', '1'], { timeout: 30000, env: { ...process.env }, stdio: ['pipe', 'pipe', 'pipe'], }); if (result.status === 0) { return { valid: true }; } const output = ((result.stdout?.tostring() || '') + (result.stderr?.tostring() || '')).trim(); const lower = output.tolowercase(); const isautherror = lower.i

cli/commands/shell.jsView file

8import readline from 'node:readline'; L9: import net from 'node:net'; L10: import fs from 'node:fs'; ... L12: import path from 'node:path'; L13: import { execFileSync } from 'node:child_process'; L14: import { bold, dim, cyan } from '../lib/colors.js'; L15: L16: const BAIZE_DIR = process.env.BAIZE_DIR || path.join(os.homedir(), 'baize'); L17: const C4_RECEIVE = path.join(BAIZE_DIR, '.claude', 'skills', 'comm-bridge', 'scripts', 'c4-receive.js');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/commands/shell.jsView on unpkg · L8

scripts/postinstall.jsView file

17Install-time code directly mutates a foreign AI-agent control surface: L25: const BAIZE_DIR = process.env.BAIZE_DIR || path.join(process.env.HOME, 'baize'); L26: const SKILLS_DIR = path.join(BAIZE_DIR, '.claude', 'skills'); L27: const CORE_SKILLS_SRC = path.join(__dirname, '..', 'skills'); ... L92: const syncHooks = path.join(__dirname, '..', 'cli', 'lib', 'sync-settings-hooks.js'); L93: const templateSettings = path.join(__dirname, '..', 'templates', '.claude', 'settings.json'); L94: ... L112: L113: // Baize must be initialized — .claude/ directory exists after `baize init` L114: const claudeDir = path.join(BAIZE_DIR, '.claude'); L115: if (!fs.existsSync(claudeDir)) { Write operation from cli/lib/fs-utils.js: L17: base = path.join(os.homedir(), 'tmp'); L18: fs.mkdirSync(base, { recursiv

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L17

skills/create-skill/scripts/init-skill.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: const scriptsdir = path.join(skilldir, 'scripts'); fs.mkdirsync(scriptsdir); const examplescript = path.join(scriptsdir, 'example.js'); fs.writefilesync(examplescript, generateexamplescript(skillname)); fs.chmodsync(examplescript, 0o755); console.log('created scripts/example.js'); const refsdir = path.join(skilldir, 'references'); fs.mkdirsync(refsdir); fs.writefilesync(path.join(refsdir, 'api-reference.md'), generateexamplereference(skillname)); console.log('created references/api-reference.md'); const assetsdir = path.join(skilldir, 'assets'); fs.mkdirsync(assetsdir); fs.writefilesync(path.join(asset

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

skills/create-skill/scripts/init-skill.jsView on unpkg

cli/lib/upgrade.jsView file

509try { L510: execSync('npm install --omit=dev', { L511: cwd: ctx.skillDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/lib/upgrade.jsView on unpkg · L509

docker/entrypoint.shView file

•path = docker/entrypoint.sh kind = build_helper sizeBytes = 10637 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docker/entrypoint.shView on unpkg

.npm-cache/_cacache/content-v2/sha512/61/51/888f691a98b493c70e8db198e80717d2c2c9f4c9c75eb26738a7e436d5ce733ee675a65f8d7f155dc4fb5d1ef98d54e43a5d2606e0052dcadfc58bb0f5e9View file

•path = .npm-cache/_cacache/content-[redacted] kind = high_entropy_blob sizeBytes = 4317 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.npm-cache/_cacache/content-v2/sha512/61/51/888f691a98b493c70e8db198e80717d2c2c9f4c9c75eb26738a7e436d5ce733ee675a65f8d7f155dc4fb5d1ef98d54e43a5d2606e0052dcadfc58bb0f5e9View on unpkg

•path = .npm-cache/_cacache/content-[redacted] kind = compressed_blob sizeBytes = 4317 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

.npm-cache/_cacache/content-v2/sha512/61/51/888f691a98b493c70e8db198e80717d2c2c9f4c9c75eb26738a7e436d5ce733ee675a65f8d7f155dc4fb5d1ef98d54e43a5d2606e0052dcadfc58bb0f5e9View on unpkg

test/integration/runtime/run.shView file

•path = test/integration/runtime/run.sh kind = payload_in_excluded_dir sizeBytes = 13543 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/integration/runtime/run.shView on unpkg

cli/lib/runtime-setup.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli/lib/runtime-setup.js#virtual:normalized:round1View on unpkg

skills/web-console/scripts/server.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.12 matchedPath = skills/web-console/scripts/server.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High