@baize-ai/core@0.3.18

Baize (白泽) — autonomous AI agent infrastructure

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a guarded, first-party agent-extension lifecycle action rather than a confirmed malicious attack. Automatic trust and hook configuration warrants a warning under the lifecycle policy.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall runs after installation when the Baize directory already contains .claude.

Impact

This is an automatic first-party agent extension configuration change that can alter Codex behavior for the Baize project.

Mechanism

The postinstall launcher invokes the settings synchronizer, which can write global and project Codex configuration, enable hooks, and trust the Baize project.

AI rationale

This is a guarded, first-party agent-extension lifecycle action rather than a confirmed malicious attack. Automatic trust and hook configuration warrants a warning under the lifecycle policy.

Evidence

package.jsonscripts/postinstall.jscli/lib/sync-settings-hooks.jscli/lib/runtime-setup.js~/.codex/config.toml~/baize/.codex/config.toml~/baize/.codex/hooks.json

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package declares an automatic postinstall hook.
Postinstall runs the settings synchronizer whenever an existing Baize .claude directory is present.
The synchronizer activates on an existing Codex config or auth file and writes refreshed configuration.
The configuration writer enables Codex hooks and marks the Baize project trusted in the global Codex config.

Evidence against

The lifecycle action is gated on an already initialized Baize directory.
The installed Codex hook is scoped to the Baize project directory rather than arbitrary projects.
No package-owned network endpoint or credential transmission was identified in the active postinstall path.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinified

Source & flagged code

31 flagged

package.jsonView file

Lines 1-31json

2 "name": "@baize-ai/core",

3 "version": "0.3.18",

4 "type": "module",

5 "description": "Baize (白泽) — autonomous AI agent infrastructure",

6 "main": "cli/baize.js",

7 "bin": {

8 "baize": "./cli/baize.js"

9 },

10 "scripts": {

11 "postinstall": "node scripts/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "pretest": "node scripts/install-skill-deps.js",

13 "test": "npm run test:jest && npm run test:node",

14 "test:jest": "node --experimental-vm-modules node_modules/.bin/jest",

15 "test:node": "node scripts/run-node-tests.js"

16 },

17 "repository": {

18 "type": "git",

19 "url": "https://github.com/baize-ai/baize-core.git"

20 },

21 "keywords": [

22 "ai",

23 "agent",

24 "claude",

25 "autonomous"

26 ],

27 "author": "Baize AI",

28 "license": "MIT",

29 "engines": {

30 "node": ">=20.20.0"

31 },

cli/lib/sync-settings-hooks.jsView file

21import os from 'os'; L22: import { execFileSync } from 'child_process'; L23: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

cli/lib/sync-settings-hooks.jsView on unpkg · L21

cli/commands/init.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. cli/commands/init.js: isValidBaseUrl, saveClaudeBaseUrl, [redacted], saveCodexBaseUrl, saveCodexBaseUrlToEnv, * ~/.claude/bin, ~/baize/bin (components), ~/.local/node/bin. * ~/.local/bin, ~/.claude/bin, ~/baize/bin, ~/.local/node/bin. fs.writeFileSync(envPath, content);

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

cli/commands/init.jsView on unpkg

9import fs from 'node:fs'; L10: import https from 'node:https'; L11: import os from 'node:os'; ... L13: import { createRequire } from 'node:module'; L14: import { execSync, execFileSync, spawnSync, spawn } from 'node:child_process'; L15: import { BAIZE_DIR, SKILLS_DIR, CONFIG_DIR, COMPONENTS_DIR, LOCKS_DIR, COMPONENTS_FILE, BIN_DIR, HTTP_DIR, CADDYFILE, CADDY_BIN, getBaizeConfig, updateBaizeConfig } from '../lib/co... ... L85: function installSystemPackage(pkg) { L86: const platform = process.platform; L87: const sudo = process.getuid?.() === 0 ? '' : 'sudo '; ... L134: * L135: * D61 fix: (1) bash login shells read ~/.profile (NOT ~/.bashrc), zsh login L136: * shells read ~/.zprofile (NOT ~/.zshrc) — write BOTH files per shell so

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/commands/init.jsView on unpkg · L9

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. function verifysetuptoken() { try { const result = spawnsync('claude', ['-p', 'hi', '--max-turns', '1'], { timeout: 30000, env: { ...process.env, path: completebinpath() }, stdio: ['pipe', 'pipe', 'pipe'], }); if (result.status === 0) { return { valid: true }; } const output = ((result.stdout?.tostring() || '') + (result.stderr?.tostring() || '')).trim(); const lower = output.tolowercase(); const isautherror = lower.includes('401') || lower.includes('unauthorized') || lower.includes('authentication') || lower.includes('invalid token') || lower.includes('invalid key') || lower.includes('expired') || lower.i

cli/commands/shell.jsView file

8import readline from 'node:readline'; L9: import net from 'node:net'; L10: import fs from 'node:fs'; ... L12: import path from 'node:path'; L13: import { execFileSync } from 'node:child_process'; L14: import { bold, dim, cyan } from '../lib/colors.js'; L15: L16: const BAIZE_DIR = process.env.BAIZE_DIR || path.join(os.homedir(), 'baize'); L17: const C4_RECEIVE = path.join(BAIZE_DIR, '.claude', 'skills', 'comm-bridge', 'scripts', 'c4-receive.js');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/commands/shell.jsView on unpkg · L8

scripts/postinstall.jsView file

17Install-time code directly mutates a foreign AI-agent control surface: L25: const BAIZE_DIR = process.env.BAIZE_DIR || path.join(process.env.HOME, 'baize'); L26: const SKILLS_DIR = path.join(BAIZE_DIR, '.claude', 'skills'); L27: const CORE_SKILLS_SRC = path.join(__dirname, '..', 'skills'); ... L92: const syncHooks = path.join(__dirname, '..', 'cli', 'lib', 'sync-settings-hooks.js'); L93: const templateSettings = path.join(__dirname, '..', 'templates', '.claude', 'settings.json'); L94: ... L112: L113: // Baize must be initialized — .claude/ directory exists after `baize init` L114: const claudeDir = path.join(BAIZE_DIR, '.claude'); L115: if (!fs.existsSync(claudeDir)) { Write operation from cli/lib/fs-utils.js: L17: base = path.join(os.homedir(), 'tmp'); L18: fs.mkdirSync(base, { recursiv

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L17

skills/create-skill/scripts/init-skill.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: const scriptsdir = path.join(skilldir, 'scripts'); fs.mkdirsync(scriptsdir); const examplescript = path.join(scriptsdir, 'example.js'); fs.writefilesync(examplescript, generateexamplescript(skillname)); fs.chmodsync(examplescript, 0o755); console.log('created scripts/example.js'); const refsdir = path.join(skilldir, 'references'); fs.mkdirsync(refsdir); fs.writefilesync(path.join(refsdir, 'api-reference.md'), generateexamplereference(skillname)); console.log('created references/api-reference.md'); const assetsdir = path.join(skilldir, 'assets'); fs.mkdirsync(assetsdir); fs.writefilesync(path.join(asset

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

skills/create-skill/scripts/init-skill.jsView on unpkg

cli/lib/upgrade.jsView file

513try { L514: execSync('npm install --omit=dev', { L515: cwd: ctx.skillDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/lib/upgrade.jsView on unpkg · L513

docker/entrypoint.shView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.17 matchedPath = docker/entrypoint.sh matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

docker/entrypoint.shView on unpkg

•path = docker/entrypoint.sh kind = build_helper sizeBytes = 9724 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docker/entrypoint.shView on unpkg

.npm-cache/_cacache/content-v2/sha512/61/51/888f691a98b493c70e8db198e80717d2c2c9f4c9c75eb26738a7e436d5ce733ee675a65f8d7f155dc4fb5d1ef98d54e43a5d2606e0052dcadfc58bb0f5e9View file

•path = .npm-cache/_cacache/content-[redacted] kind = high_entropy_blob sizeBytes = 4317 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.npm-cache/_cacache/content-v2/sha512/61/51/888f691a98b493c70e8db198e80717d2c2c9f4c9c75eb26738a7e436d5ce733ee675a65f8d7f155dc4fb5d1ef98d54e43a5d2606e0052dcadfc58bb0f5e9View on unpkg

•path = .npm-cache/_cacache/content-[redacted] kind = compressed_blob sizeBytes = 4317 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

.npm-cache/_cacache/content-v2/sha512/61/51/888f691a98b493c70e8db198e80717d2c2c9f4c9c75eb26738a7e436d5ce733ee675a65f8d7f155dc4fb5d1ef98d54e43a5d2606e0052dcadfc58bb0f5e9View on unpkg

test/integration/runtime/run.shView file

•path = test/integration/runtime/run.sh kind = payload_in_excluded_dir sizeBytes = 13543 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/integration/runtime/run.shView on unpkg

core.tgzView file

•path = core.tgz kind = nested_archive_needs_inspection sizeBytes = 54419707 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

core.tgzView on unpkg

cli/lib/runtime-setup.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli/lib/runtime-setup.js#virtual:normalized:round1View on unpkg

skills/web-console/scripts/server.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.17 matchedPath = skills/web-console/scripts/server.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/web-console/scripts/server.jsView on unpkg

cli/commands/add.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.17 matchedPath = cli/commands/add.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/commands/add.jsView on unpkg

cli/commands/doctor.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.17 matchedPath = cli/commands/doctor.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/commands/doctor.jsView on unpkg

cli/lib/runtime-setup.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.17 matchedPath = cli/lib/runtime-setup.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/lib/runtime-setup.jsView on unpkg

cli/lib/runtime/codex.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.17 matchedPath = cli/lib/runtime/codex.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/lib/runtime/codex.jsView on unpkg

scripts/e2e/issue-492-web-tool-watchdog.shView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.17 matchedPath = scripts/e2e/issue-492-web-tool-watchdog.sh matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/e2e/issue-492-web-tool-watchdog.shView on unpkg

skills/activity-monitor/scripts/monitor.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.17 matchedPath = skills/activity-monitor/scripts/monitor.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/activity-monitor/scripts/monitor.jsView on unpkg

skills/activity-monitor/scripts/proc-sampler.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.17 matchedPath = skills/activity-monitor/scripts/proc-sampler.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/activity-monitor/scripts/proc-sampler.jsView on unpkg

skills/http/scripts/setup-caddy.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.17 matchedPath = skills/http/scripts/setup-caddy.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/http/scripts/setup-caddy.jsView on unpkg

skills/web-console/scripts/admin-auth.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.17 matchedPath = skills/web-console/scripts/admin-auth.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/web-console/scripts/admin-auth.jsView on unpkg

skills/web-console/scripts/channel-admin.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.17 matchedPath = skills/web-console/scripts/channel-admin.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/web-console/scripts/channel-admin.jsView on unpkg

Source & flagged code

31 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

cli/lib/sync-settings-hooks.jsView file

21import os from 'os'; L22: import { execFileSync } from 'child_process'; L23: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

cli/lib/sync-settings-hooks.jsView on unpkg · L21

Findings

1 Critical25 High8 Medium5 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processcli/lib/sync-settings-hooks.js

HighShell

HighSame File Env Network Executioncli/commands/shell.js

HighCredential Redirect Persistencecli/commands/init.js

HighSandbox Evasion Gated Capabilitycli/commands/init.js

HighExternal Ai Agent Control Surface Mutationskills/create-skill/scripts/init-skill.js

HighTrigger Reachable External Ai Agent Control Surface Mutationcli/commands/init.js

HighTrigger Reachable Persistencecli/commands/init.js

HighRuntime Package Installcli/lib/upgrade.js

Affected versions and remediation

This report applies to @baize-ai/core@0.3.18.

See all versions of @baize-ai/core for other recorded verdicts.

Review the evidence and your use of @baize-ai/core@0.3.18 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-22 16:40:47.090Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.