@baize-ai/core@0.3.9

⚠ Under review

Baize (白泽) — autonomous AI agent infrastructure

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 38 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 150 file(s), 1.52 MB of source, external domains: a2a.example.com, admin.example.com, api.github.com, api.openai.com, claude-proxy.example.com, claude.ai, console.anthropic.com, example.com, github.com, open.feishu.cn, pm2.keymetrics.io, proxy.example.com, raw.githubusercontent.com, registry.npmjs.org, registry.npmmirror.com, work.weixin.qq.com

Source & flagged code

30 flagged

package.jsonView file

Lines 1-31json

2 "name": "@baize-ai/core",

3 "version": "0.3.9",

4 "type": "module",

5 "description": "Baize (\u767d\u6cfd) \u2014 autonomous AI agent infrastructure",

6 "main": "cli/baize.js",

7 "bin": {

8 "baize": "./cli/baize.js"

9 },

10 "scripts": {

11 "postinstall": "node scripts/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "pretest": "node scripts/install-skill-deps.js",

13 "test": "npm run test:jest && npm run test:node",

14 "test:jest": "node --experimental-vm-modules node_modules/.bin/jest",

15 "test:node": "node scripts/run-node-tests.js"

16 },

17 "repository": {

18 "type": "git",

19 "url": "https://github.com/baize-ai/baize-core.git"

20 },

21 "keywords": [

22 "ai",

23 "agent",

24 "claude",

25 "autonomous"

26 ],

27 "author": "Baize AI",

28 "license": "MIT",

29 "engines": {

30 "node": ">=20.20.0"

31 },

cli/lib/sync-settings-hooks.jsView file

Lines 1-41javascript

1#!/usr/bin/env node

2/**

3 * Sync settings.json hooks to installed settings.

4 *

5 * Compares desired runtime hooks with installed hooks by script path:

6 * - Missing hooks → add

7 * - Modified hooks → update (command, timeout)

8 * - Removed hooks (core skills only) → remove

9 * - User hooks (non-core skills) → preserve

10 *

11 * Called from postinstall.js and from self-upgrade step 8 (which shells

cli/commands/init.jsView file

Lines 1-29javascript

1/**

2 * baize init - Initialize Baize environment

3 *

4 * Sets up the directory structure, checks prerequisites,

5 * syncs Core Skills, deploys templates, and starts services.

6 */

8import crypto from 'node:crypto';

9import fs from

cli/commands/shell.jsView file

Lines 1-28javascript

1/**

2 * baize shell — CLI interactive mode

3 *

4 * Minimal-dependency REPL that communicates with Claude via C4.

5 * Uses a Unix domain socket for real-time response delivery.

6 */

8import readline from 'node:readline';

9import net from

scripts/postinstall.jsView file

Lines 1-37javascript

1/**

2 * Postinstall script - runs after `npm install -g baize`

3 *

4 * Two responsibilities:

5 * 1. Sync Core Skills (skipped during self-upgrade — step 5 handles it)

6 * 2. Sync settings.json hooks/statusLine and refresh Codex config backfills

7 * (ALWAYS runs when baize is initialized)

8 *

9 * Settings sync runs even when BAIZE_SKIP_POSTINSTALL is set because this is

10 * the only reliable hook where the NEWLY INSTALLED code executes during

skills/create-skill/scripts/init-skill.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: const scriptsdir = path.join(skilldir, 'scripts'); fs.mkdirsync(scriptsdir); const examplescript = path.join(scriptsdir, 'example.js'); fs.writefilesync(examplescript, generateexamplescript(skillname)); fs.chmodsync(examplescript, 0o755); console.log('created scripts/example.js'); const refsdir = path.join(skilldir, 'references'); fs.mkdirsync(refsdir); fs.writefilesync(path.join(refsdir, 'api-reference.md'), generateexamplereference(skillname)); console.log('created references/api-reference.md'); const assetsdir = path.join(skilldir, 'assets'); fs.mkdirsync(assetsdir); fs.writefilesync(path.join(asset

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

skills/create-skill/scripts/init-skill.jsView on unpkg

cli/lib/upgrade.jsView file

509try { L510: execSync('npm install --omit=dev', { L511: cwd: ctx.skillDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/lib/upgrade.jsView on unpkg · L509

docker/entrypoint.shView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.1 matchedPath = docker/entrypoint.sh matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

docker/entrypoint.shView on unpkg

•path = docker/entrypoint.sh kind = build_helper sizeBytes = 8961 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docker/entrypoint.shView on unpkg

.npm-cache/_cacache/content-v2/sha512/61/51/888f691a98b493c70e8db198e80717d2c2c9f4c9c75eb26738a7e436d5ce733ee675a65f8d7f155dc4fb5d1ef98d54e43a5d2606e0052dcadfc58bb0f5e9View file

•path = .npm-cache/_cacache/content-[redacted] kind = high_entropy_blob sizeBytes = 4317 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.npm-cache/_cacache/content-v2/sha512/61/51/888f691a98b493c70e8db198e80717d2c2c9f4c9c75eb26738a7e436d5ce733ee675a65f8d7f155dc4fb5d1ef98d54e43a5d2606e0052dcadfc58bb0f5e9View on unpkg

•path = .npm-cache/_cacache/content-[redacted] kind = compressed_blob sizeBytes = 4317 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

.npm-cache/_cacache/content-v2/sha512/61/51/888f691a98b493c70e8db198e80717d2c2c9f4c9c75eb26738a7e436d5ce733ee675a65f8d7f155dc4fb5d1ef98d54e43a5d2606e0052dcadfc58bb0f5e9View on unpkg

test/integration/runtime/run.shView file

•path = test/integration/runtime/run.sh kind = payload_in_excluded_dir sizeBytes = 13543 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/integration/runtime/run.shView on unpkg

cli/lib/runtime-setup.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli/lib/runtime-setup.js#virtual:normalized:round1View on unpkg

cli/commands/add.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.17 matchedPath = cli/commands/add.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/commands/add.jsView on unpkg

cli/commands/doctor.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.15 matchedPath = cli/commands/doctor.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/commands/doctor.jsView on unpkg

cli/lib/runtime-setup.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.15 matchedPath = cli/lib/runtime-setup.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/lib/runtime-setup.jsView on unpkg

scripts/e2e/issue-492-web-tool-watchdog.shView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.17 matchedPath = scripts/e2e/issue-492-web-tool-watchdog.sh matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/e2e/issue-492-web-tool-watchdog.shView on unpkg

skills/activity-monitor/scripts/monitor.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.17 matchedPath = skills/activity-monitor/scripts/monitor.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/activity-monitor/scripts/monitor.jsView on unpkg

skills/activity-monitor/scripts/proc-sampler.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.17 matchedPath = skills/activity-monitor/scripts/proc-sampler.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/activity-monitor/scripts/proc-sampler.jsView on unpkg

skills/http/scripts/setup-caddy.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.17 matchedPath = skills/http/scripts/setup-caddy.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/http/scripts/setup-caddy.jsView on unpkg

skills/web-console/scripts/codex-login.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.17 matchedPath = skills/web-console/scripts/codex-login.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/web-console/scripts/codex-login.jsView on unpkg

skills/web-console/scripts/feishu-admin.jsView file

•matchType = normalized_sha256 matchedPackage = @baize-ai/core@0.3.17 matchedPath = skills/web-console/scripts/feishu-admin.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/web-console/scripts/feishu-admin.jsView on unpkg

skills/web-console/scripts/server.jsView file

•matchType = token_shingles matchedPackage = @baize-ai/core@0.3.1 matchedPath = skills/web-console/scripts/server.js matchedIdentity = npm:QGJhaXplLWFpL2NvcmU:0.3.1 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/web-console/scripts/server.jsView on unpkg

Source & flagged code

30 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

cli/lib/sync-settings-hooks.jsView file

21import os from 'os'; L22: import { execFileSync } from 'child_process'; L23: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

cli/lib/sync-settings-hooks.jsView on unpkg · L21

Findings

1 Critical25 High8 Medium4 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processcli/lib/sync-settings-hooks.js

HighShell

HighSame File Env Network Executioncli/commands/shell.js

HighCredential Redirect Persistencecli/commands/init.js

HighSandbox Evasion Gated Capabilitycli/commands/init.js

HighExternal Ai Agent Control Surface Mutationskills/create-skill/scripts/init-skill.js

HighTrigger Reachable External Ai Agent Control Surface Mutationcli/commands/init.js

HighTrigger Reachable Persistencecli/commands/init.js

HighRuntime Package Installcli/lib/upgrade.js

Affected versions and remediation

This report applies to @baize-ai/core@0.3.9.

See all versions of @baize-ai/core for other recorded verdicts.

Review the evidence and your use of @baize-ai/core@0.3.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 15:30:06.908Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.