@baize-ai/core@0.3.16

Baize (白泽) — autonomous AI agent infrastructure

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a first-party agent extension setup performed automatically during package installation or upgrade. It warrants a warning because it changes persistent Codex trust and hook settings, but the inspected code does not establish a concrete malicious chain.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall when the Baize workspace already contains .claude and Codex state is present.

Impact

A package upgrade can enable persistent agent hooks and trust settings without an interactive prompt.

Mechanism

Lifecycle-driven Codex configuration, trust, and hook installation.

AI rationale

Evidence

package.jsonscripts/postinstall.jscli/lib/sync-settings-hooks.jscli/lib/runtime-setup.js~/.codex/config.toml<BAIZE_DIR>/.codex/hooks.json

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs a postinstall lifecycle script.
Postinstall proceeds whenever an existing Baize .claude directory is present and always invokes settings synchronization.
Synchronization can run solely because Codex auth or config already exists.
The sync writes global Codex configuration, marks the Baize directory trusted, and installs session-start hooks.

Evidence against

No self-dependency is declared in package.json.
The inspected lifecycle code contains no credential exfiltration or external network request.
The mutations target the package's Baize workspace and add-on runtime integration rather than arbitrary projects.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Source & flagged code

30 flagged

package.jsonView file

Lines 1-31json

2 "name": "@baize-ai/core",

3 "version": "0.3.16",

4 "type": "module",

5 "description": "Baize (白泽) — autonomous AI agent infrastructure",

6 "main": "cli/baize.js",

7 "bin": {

8 "baize": "./cli/baize.js"

9 },

10 "scripts": {

11 "postinstall": "node scripts/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "pretest": "node scripts/install-skill-deps.js",

13 "test": "npm run test:jest && npm run test:node",

14 "test:jest": "node --experimental-vm-modules node_modules/.bin/jest",

15 "test:node": "node scripts/run-node-tests.js"

16 },

17 "repository": {

18 "type": "git",

19 "url": "https://github.com/baize-ai/baize-core.git"

20 },

21 "keywords": [

22 "ai",

23 "agent",

24 "claude",

25 "autonomous"

26 ],

27 "author": "Baize AI",

28 "license": "MIT",

29 "engines": {

30 "node": ">=20.20.0"

31 },

cli/lib/sync-settings-hooks.jsView file

21import os from 'os'; L22: import { execFileSync } from 'child_process'; L23: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

cli/lib/sync-settings-hooks.jsView on unpkg · L21

cli/commands/init.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. cli/commands/init.js: isValidBaseUrl, saveClaudeBaseUrl, [redacted], saveCodexBaseUrl, saveCodexBaseUrlToEnv, fs.writeFileSync(envPath, content); fs.writeFileSync(envPath, content); * Save an Anthropic API key to ~/.claude/settings.json and process.env.

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

cli/commands/init.jsView on unpkg

9import fs from 'node:fs'; L10: import https from 'node:https'; L11: import os from 'node:os'; ... L13: import { createRequire } from 'node:module'; L14: import { execSync, execFileSync, spawnSync, spawn } from 'node:child_process'; L15: import { BAIZE_DIR, SKILLS_DIR, CONFIG_DIR, COMPONENTS_DIR, LOCKS_DIR, COMPONENTS_FILE, BIN_DIR, HTTP_DIR, CADDYFILE, CADDY_BIN, getBaizeConfig, updateBaizeConfig } from '../lib/co... ... L84: function installSystemPackage(pkg) { L85: const platform = process.platform; L86: const sudo = process.getuid?.() === 0 ? '' : 'sudo '; ... L121: function ensureLocalBinInProfile() { L122: const homedir = os.homedir(); L123: const shell = (process.env.SHELL || '').split('/').pop();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/commands/init.jsView on unpkg · L9

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ); } function verifysetuptoken() { try { const result = spawnsync('claude', ['-p', 'hi', '--max-turns', '1'], { timeout: 30000, env: { ...process.env }, stdio: ['pipe', 'pipe', 'pipe'], }); if (result.status === 0) { return { valid: true }; } const output = ((result.stdout?.tostring() || '') + (result.stderr?.tostring() || '')).trim(); const lower = output.tolowercase(); const isautherror = lower.i

cli/commands/shell.jsView file

Lines 1-28javascript

1/**

2 * baize shell — CLI interactive mode

3 *

4 * Minimal-dependency REPL that communicates with Claude via C4.

5 * Uses a Unix domain socket for real-time response delivery.

6 */

8import readline from 'node:readline';

9import net from

scripts/postinstall.jsView file

17Install-time code directly mutates a foreign AI-agent control surface: L25: const BAIZE_DIR = process.env.BAIZE_DIR || path.join(process.env.HOME, 'baize'); L26: const SKILLS_DIR = path.join(BAIZE_DIR, '.claude', 'skills'); L27: const CORE_SKILLS_SRC = path.join(__dirname, '..', 'skills'); ... L92: const syncHooks = path.join(__dirname, '..', 'cli', 'lib', 'sync-settings-hooks.js'); L93: const templateSettings = path.join(__dirname, '..', 'templates', '.claude', 'settings.json'); L94: ... L112: L113: // Baize must be initialized — .claude/ directory exists after `baize init` L114: const claudeDir = path.join(BAIZE_DIR, '.claude'); L115: if (!fs.existsSync(claudeDir)) { Write operation from cli/lib/fs-utils.js: L17: base = path.join(os.homedir(), 'tmp'); L18: fs.mkdirSync(base, { recursiv

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L17

skills/create-skill/scripts/init-skill.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: const scriptsdir = path.join(skilldir, 'scripts'); fs.mkdirsync(scriptsdir); const examplescript = path.join(scriptsdir, 'example.js'); fs.writefilesync(examplescript, generateexamplescript(skillname)); fs.chmodsync(examplescript, 0o755); console.log('created scripts/example.js'); const refsdir = path.join(skilldir, 'references'); fs.mkdirsync(refsdir); fs.writefilesync(path.join(refsdir, 'api-reference.md'), generateexamplereference(skillname)); console.log('created references/api-reference.md'); const assetsdir = path.join(skilldir, 'assets'); fs.mkdirsync(assetsdir); fs.writefilesync(path.join(asset

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

skills/create-skill/scripts/init-skill.jsView on unpkg

cli/lib/upgrade.jsView file

513try { L514: execSync('npm install --omit=dev', { L515: cwd: ctx.skillDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/lib/upgrade.jsView on unpkg · L513

docker/entrypoint.shView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.15 matchedPath = docker/entrypoint.sh matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

docker/entrypoint.shView on unpkg

•path = docker/entrypoint.sh kind = build_helper sizeBytes = 9527 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docker/entrypoint.shView on unpkg

.npm-cache/_cacache/content-v2/sha512/61/51/888f691a98b493c70e8db198e80717d2c2c9f4c9c75eb26738a7e436d5ce733ee675a65f8d7f155dc4fb5d1ef98d54e43a5d2606e0052dcadfc58bb0f5e9View file

•path = .npm-cache/_cacache/content-[redacted] kind = high_entropy_blob sizeBytes = 4317 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.npm-cache/_cacache/content-v2/sha512/61/51/888f691a98b493c70e8db198e80717d2c2c9f4c9c75eb26738a7e436d5ce733ee675a65f8d7f155dc4fb5d1ef98d54e43a5d2606e0052dcadfc58bb0f5e9View on unpkg

•path = .npm-cache/_cacache/content-[redacted] kind = compressed_blob sizeBytes = 4317 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

.npm-cache/_cacache/content-v2/sha512/61/51/888f691a98b493c70e8db198e80717d2c2c9f4c9c75eb26738a7e436d5ce733ee675a65f8d7f155dc4fb5d1ef98d54e43a5d2606e0052dcadfc58bb0f5e9View on unpkg

test/integration/runtime/run.shView file

•path = test/integration/runtime/run.sh kind = payload_in_excluded_dir sizeBytes = 13543 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/integration/runtime/run.shView on unpkg

cli/lib/runtime-setup.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli/lib/runtime-setup.js#virtual:normalized:round1View on unpkg

skills/web-console/scripts/server.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.15 matchedPath = skills/web-console/scripts/server.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/web-console/scripts/server.jsView on unpkg

cli/commands/add.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.15 matchedPath = cli/commands/add.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/commands/add.jsView on unpkg

cli/commands/doctor.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.15 matchedPath = cli/commands/doctor.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/commands/doctor.jsView on unpkg

scripts/e2e/issue-492-web-tool-watchdog.shView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.15 matchedPath = scripts/e2e/issue-492-web-tool-watchdog.sh matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/e2e/issue-492-web-tool-watchdog.shView on unpkg

skills/activity-monitor/scripts/proc-sampler.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.15 matchedPath = skills/activity-monitor/scripts/proc-sampler.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/activity-monitor/scripts/proc-sampler.jsView on unpkg

skills/http/scripts/setup-caddy.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.15 matchedPath = skills/http/scripts/setup-caddy.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/http/scripts/setup-caddy.jsView on unpkg

skills/web-console/scripts/admin-auth.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.15 matchedPath = skills/web-console/scripts/admin-auth.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/web-console/scripts/admin-auth.jsView on unpkg

skills/web-console/scripts/channel-admin.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.15 matchedPath = skills/web-console/scripts/channel-admin.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/web-console/scripts/channel-admin.jsView on unpkg

skills/web-console/scripts/codex-login.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.15 matchedPath = skills/web-console/scripts/codex-login.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/web-console/scripts/codex-login.jsView on unpkg

skills/web-console/scripts/feishu-admin.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.15 matchedPath = skills/web-console/scripts/feishu-admin.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/web-console/scripts/feishu-admin.jsView on unpkg

cli/commands/self-uninstall.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.15 matchedPath = cli/commands/self-uninstall.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/commands/self-uninstall.jsView on unpkg

Source & flagged code

30 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

cli/lib/sync-settings-hooks.jsView file

21import os from 'os'; L22: import { execFileSync } from 'child_process'; L23: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

cli/lib/sync-settings-hooks.jsView on unpkg · L21

Findings

1 Critical25 High8 Medium4 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processcli/lib/sync-settings-hooks.js

HighShell

HighSame File Env Network Executioncli/commands/shell.js

HighCredential Redirect Persistencecli/commands/init.js

HighSandbox Evasion Gated Capabilitycli/commands/init.js

HighExternal Ai Agent Control Surface Mutationskills/create-skill/scripts/init-skill.js

HighTrigger Reachable External Ai Agent Control Surface Mutationcli/commands/init.js

HighTrigger Reachable Persistencecli/commands/init.js

HighRuntime Package Installcli/lib/upgrade.js

Affected versions and remediation

This report applies to @baize-ai/core@0.3.16.

See all versions of @baize-ai/core for other recorded verdicts.

Review the evidence and your use of @baize-ai/core@0.3.16 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 03:34:45.234Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code