registry / Credential exfiltration / @linzumi/cli
@linzumi/cli
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
This report shows the evidence for @linzumi/cli@1.0.311. 1 of 149 known versions is blocked or flagged. The newest version, 1.0.328, is allowed. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe CLI routes Anthropic API-key authentication through Linzumi’s proxy in applicable agent contexts, sending a third-party provider credential to the package vendor without clear disclosure or consent. This meets the credential-exfiltration rule despite the otherwise legitimate CLI purpose.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Run the CLI and start an agent using an Anthropic API key in a context with a Linzumi proxy binding.
Impact
The vendor proxy receives the user’s Anthropic credential, exposing it to use outside the user’s direct Anthropic connection.
Mechanism
The routing logic identifies API-key authentication and selects LlmProxy; the configured provider sends model requests through the Linzumi proxy endpoint.
Attack narrative
When an agent uses Anthropic API-key authentication and a Linzumi proxy binding is present, the CLI selects the LlmProxy lane. It configures that provider as “Linzumi Proxy” and directs model requests to the configured proxy base URL. This sends the user’s provider credential through the vendor’s service without clear disclosure in the package documentation.
AI rationale
The CLI routes Anthropic API-key authentication through Linzumi’s proxy in applicable agent contexts, sending a third-party provider credential to the package vendor without clear disclosure or consent. This meets the credential-exfiltration rule despite the otherwise legitimate CLI purpose.
Evidence
dist/index.jsbin/linzumi.js
Network endpoints2
serve.linzumi.comconfigured llmProxyBaseUrl
Decision evidence
public snapshotAI called this Malicious at 90.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CLI detects ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN and routes user API key credentials through the LlmProxy lane when a proxy binding applies.
- The proxy provider is named “Linzumi Proxy” and sends model requests to the configured proxy base URL at /v1.
- The executable entry point calls main() with the user’s CLI arguments; the README describes signing in and connecting to a Linzumi workspace.
- The package sets https://serve.linzumi.com as its default service endpoint.
Evidence against
- The package has no install, preinstall, or postinstall hook.
- The package is a documented local coding-agent CLI, so model-provider requests are part of its stated purpose.
- The credential routing occurs in the model-provider path rather than as an install-time action.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Oversized source lightweight scan
dist/index.js4.55 MB file, sampled 256 KB
FilesystemNetworkEnvironmentVarsEvalDynamicRequireHighEntropyStringsMinifiedUrlStringsapp.linzumi.comraw.githubusercontent.com
Source & flagged code
20 flaggeddist/topics-cli.mjsView file
3var Cl=Object.create;var Qn=Object.defineProperty;var Fl=Object.getOwnPropertyDescriptor;var Nl=Object.getOwnPropertyNames;var Il=Object.getPrototypeOf,$l=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});V[le]||(fi=global[le]||[],mi(V,fi),V.close=(function(e){function t(r,n){return e.call(V,r,function(i){i||ci(),typeof n=="function"&&n.apply(this,argumen...
L5: `:return JSON.stringify(e);default:t=r+1|0;continue}}}function Tu(e){return e===""?[]:JSON.parse(e.split('"]["').join('","'))}function Au(e){return"["+Ut(e)+"]"}function vu(e){let ...
High
Child Process
Package source references child process execution.
dist/topics-cli.mjsView on unpkg · L37`),p=c.path,_=`
L8: - `+(p===""?"":"At "+p+": ")+d;f[_]||(f[_]=1,a=a+_)}}let s={code:"invalid_input",path:r,reason:a,expected:e,received:t,unionErrors:o};return i&&(s.input=n),s}function En(e,t,r,n){r...
L9: `,h=n+".tmp."+process.pid.toString()+"."+Wi(6),_=y=>A(y.message);return P(U(Kt(zr.dirname(n)),_),()=>{let y=P(Ht(h,p,{encoding:"utf8",mode:384}),()=>zi(h,n));return y.TAG==="Ok"?{T...
High
2const require = __linzumiBundleCreateRequire(import.meta.url);
L3: var Cl=Object.create;var Qn=Object.defineProperty;var Fl=Object.getOwnPropertyDescriptor;var Nl=Object.getOwnPropertyNames;var Il=Object.getPrototypeOf,$l=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});V[le]||(fi=global[le]||[],mi(V,fi),V.close=(function(e){function t(r,n){return e.call(V,r,function(i){i||ci(),typeof n=="function"&&n.apply(this,argumen...
L5: `:return JSON.stringify(e);default:t=r+1|0;continue}}}function Tu(e){return e===""?[]:JSON.parse(e.split('"]["').join('","'))}function Au(e){return"["+Ut(e)+"]"}function vu(e){let ...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/topics-cli.mjsView on unpkg · L23var Cl=Object.create;var Qn=Object.defineProperty;var Fl=Object.getOwnPropertyDescriptor;var Nl=Object.getOwnPropertyNames;var Il=Object.getPrototypeOf,$l=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});V[le]||(fi=global[le]||[],mi(V,fi),V.close=(function(e){function t(r,n){return e.call(V,r,function(i){i||ci(),typeof n=="function"&&n.apply(this,argumen...
L5: `:return JSON.stringify(e);default:t=r+1|0;continue}}}function Tu(e){return e===""?[]:JSON.parse(e.split('"]["').join('","'))}function Au(e){return"["+Ut(e)+"]"}function vu(e){let ...
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/topics-cli.mjsView on unpkg · L3dist/cloud-supervisor.mjsView file
2const require = __linzumiBundleCreateRequire(import.meta.url);
L3: var z2=Object.create;var ty=Object.defineProperty;var K2=Object.getOwnPropertyDescriptor;var H2=Object.getOwnPropertyNames;var J2=Object.getPrototypeOf,W2=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});Nt[pn]||(WC=global[pn]||[],ZC(Nt,WC),Nt.close=(function(e){function t(n,r){return e.call(Nt,n,function(i){i||VC(),typeof r=="function"&&r.apply(this,arg...
L5: `).join(`\r
...
L164: `;c++)u--;u>n&&t.push({kind:"text",text:e.slice(n,u)}),n=l+d.length;for(let c=0;c<2&&e[n]===`
L165: `;c++)n++;t.push({kind:"block",id:a,body:e.slice(s,l-1),raw:e.slice(u,n)}),r=n}return n<e.length&&t.push({kind:"text",text:e.slice(n)}),t}function Moe(e){let t=Ioe(e);return t.leng...
L166: `," ").trim();if(!a)continue;let s=BTe.ex
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cloud-supervisor.mjsView on unpkg · L22const require = __linzumiBundleCreateRequire(import.meta.url);
L3: var z2=Object.create;var ty=Object.defineProperty;var K2=Object.getOwnPropertyDescriptor;var H2=Object.getOwnPropertyNames;var J2=Object.getPrototypeOf,W2=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});Nt[pn]||(WC=global[pn]||[],ZC(Nt,WC),Nt.close=(function(e){function t(n,r){return e.call(Nt,n,function(i){i||VC(),typeof r=="function"&&r.apply(this,arg...
L5: `).join(`\r
...
L164: `;c++)u--;u>n&&t.push({kind:"text",text:e.slice(n,u)}),n=l+d.length;for(let c=0;c<2&&e[n]===`
L165: `;c++)n++;t.push({kind:"block",id:a,body:e.slice(s,l-1),raw:e.slice(u,n)}),r=n}return n<e.length&&t.push({kind:"text",text:e.slice(n)}),t}function Moe(e){let t=Ioe(e);return t.leng...
L166: `," ").trim();if(!a)continue;let s=BTe.ex
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/cloud-supervisor.mjsView on unpkg · L23var z2=Object.create;var ty=Object.defineProperty;var K2=Object.getOwnPropertyDescriptor;var H2=Object.getOwnPropertyNames;var J2=Object.getPrototypeOf,W2=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});Nt[pn]||(WC=global[pn]||[],ZC(Nt,WC),Nt.close=(function(e){function t(n,r){return e.call(Nt,n,function(i){i||VC(),typeof r=="function"&&r.apply(this,arg...
L5: `).join(`\r
...
L45: try {
L46: const parsed = JSON.parse(fs.readFileSync(path, 'utf8'));
L47: if (!parsed || typeof parsed.updatedAtMs !== 'number' || !Array.isArray(parsed.pids)) {
...
L131: `)}function cg(e){if(e!==null&&typeof e=="object"&&"code"in e){let t=e.code;return typeof t=="string"?t:void 0}}function fg(e,t={}){return["app-server",...LW(t),"--listen",e]}funct...
L132: `)}){let n=$O(e);if(n.state!=="unset"
High
Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/cloud-supervisor.mjsView on unpkg · L32Cross-file remote execution chain: dist/cloud-supervisor.mjs spawns dist/mcp-server.mjs; helper contains network access plus dynamic code execution.
L2: const require = __linzumiBundleCreateRequire(import.meta.url);
L3: var z2=Object.create;var ty=Object.defineProperty;var K2=Object.getOwnPropertyDescriptor;var H2=Object.getOwnPropertyNames;var J2=Object.getPrototypeOf,W2=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});Nt[pn]||(WC=global[pn]||[],ZC(Nt,WC),Nt.close=(function(e){function t(n,r){return e.call(Nt,n,function(i){i||VC(),typeof r=="function"&&r.apply(this,arg...
L5: `).join(`\r
...
L164: `;c++)u--;u>n&&t.push({kind:"text",text:e.slice(n,u)}),n=l+d.length;for(let c=0;c<2&&e[n]===`
L165: `;c++)n++;t.push({kind:"block",id:a,body:e.slice(s,l-1),raw:e.slice(u,n)}),r=n}ret
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/cloud-supervisor.mjsView on unpkg · L21import { createRequire as __linzumiBundleCreateRequire } from 'node:module';
L2: const require = __linzumiBundleCreateRequire(import.meta.url);
L3: var z2=Object.create;var ty=Object.defineProperty;var K2=Object.getOwnPropertyDescriptor;var H2=Object.getOwnPropertyNames;var J2=Object.getPrototypeOf,W2=Object.prototype.hasOwnPr...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/cloud-supervisor.mjsView on unpkg · L12const require = __linzumiBundleCreateRequire(import.meta.url);
L3: var z2=Object.create;var ty=Object.defineProperty;var K2=Object.getOwnPropertyDescriptor;var H2=Object.getOwnPropertyNames;var J2=Object.getPrototypeOf,W2=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});Nt[pn]||(WC=global[pn]||[],ZC(Nt,WC),Nt.close=(function(e){function t(n,r){return e.call(Nt,n,function(i){i||VC(),typeof r=="function"&&r.apply(this,arg...
L5: `).join(`\r
...
L164: `;c++)u--;u>n&&t.push({kind:"text",text:e.slice(n,u)}),n=l+d.length;for(let c=0;c<2&&e[n]===`
L165: `;c++)n++;t.push({kind:"block",id:a,body:e.slice(s,l-1),raw:e.slice(u,n)}),r=n}return n<e.length&&t.push({kind:"text",text:e.slice(n)}),t}function Moe(e){let t=Ioe(e);return t.leng...
L166: `," ").trim();if(!a)continue;let s=BTe.ex
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/cloud-supervisor.mjsView on unpkg · L2dist/index.jsView file
2const require = __linzumiBundleCreateRequire(import.meta.url);
L3: var g8e=Object.create;var R4=Object.defineProperty;var _8e=Object.getOwnPropertyDescriptor;var h8e=Object.getOwnPropertyNames;var C8e=Object.getPrototypeOf,E8e=Object.prototype.has...
L4: GFS4: `),console.error(e)});Ls[ou]||(HAe=global[ou]||[],YAe(Ls,HAe),Ls.close=(function(e){function t(r,n){return e.call(Ls,r,function(i){i||WAe(),typeof n=="function"&&n.apply(this...
L5: `:""},this._extScope=t,this._scope=new hp.Scope({parent:t}),this._nodes=[new s6]}toString(){return this._root.render(this.opts)}name(t){return this._scope.name(t)}scopeName(t){retu...
L6: || (${o} == "string" && ${i} && ${i} == +${i})`).assign(a,(0,to._)`+${i}`);return;case"integer":n.elseIf((0,to._)`${o} === "boolean" || ${i} === null
L7: || (${o} ==
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/index.jsView on unpkg · L23Trigger-reachable chain: manifest.bin -> bin/linzumi.js -> dist/index.js
L3: var g8e=Object.create;var R4=Object.defineProperty;var _8e=Object.getOwnPropertyDescriptor;var h8e=Object.getOwnPropertyNames;var C8e=Object.getPrototypeOf,E8e=Object.prototype.has...
L4: GFS4: `),console.error(e)});Ls[ou]||(HAe=global[ou]||[],YAe(Ls,HAe),Ls.close=(function(e){function t(r,n){return e.call(Ls,r,function(i){i||WAe(),typeof n=="function"&&n.apply(this...
L5: `:""},this._extScope=t,this._scope=new hp.Scope({parent:t}),this._nodes=[new s6]}toString(){return this._root.render(this.opts)}name(t){return this._scope.name(t)}scopeName(t){retu...
L6: || (${o} == "string" && ${i} && ${i} == +${i})`).assign(a,(0,to._)`+${i}`);return;case"integer":n.elseIf((0,to._)`${o} === "boolean" || ${i} === null
L7: || ($
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L3•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
GFS4: `),console.error(e)});Ls[ou]||(HAe=global[ou]||[],YAe(Ls,HAe),Ls.close=(function(e){function t(r,n){return e.call(Ls,r,function(i){i||WAe(),typeof n=="function"&&n.apply(this...
`);l=c!==void 0?{TAG:"Ok",_0:u.slice(c+1|0)}:{TAG:"Ok",_0:""}}else l={TAG:"Ok",_0:u}}catch(s){let d=U(s);l={TAG:"Error",_0:se(d)}}return Qi.closeSync(a),l}catch(r){let n=U(r);retur...
task items with project_task_id). Honor existing explicit launch authorization
Readiness alone is not authorization; do not duplicate active work.
`}function koe(e){throw e}function Soe(e){throw e}function Z4(e){throw e}function Zo(e){throw new Error(e)}functi
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg3Trigger-reachable command-output exfiltration chain: manifest.bin -> bin/linzumi.js -> dist/index.js
L3: var g8e=Object.create;var R4=Object.defineProperty;var _8e=Object.getOwnPropertyDescriptor;var h8e=Object.getOwnPropertyNames;var C8e=Object.getPrototypeOf,E8e=Object.prototype.has...
L4: GFS4: `),console.error(e)});Ls[ou]||(HAe=global[ou]||[],YAe(Ls,HAe),Ls.close=(function(e){function t(r,n){return e.call(Ls,r,function(i){i||WAe(),typeof n=="function"&&n.apply(this...
L5: `:""},this._extScope=t,this._scope=new hp.Scope({parent:t}),this._nodes=[new s6]}toString(){return this._root.render(this.opts)}name(t){return this._scope.name(t)}scopeName(t){retu...
L6: || (${o} == "string" && ${i} && ${i} == +${i})`).assign(a,(0,to._)`+${i}`);return;case"integer":n.elseIf((0,to._)`${o} === "boolean
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.jsView on unpkg · L3167args = `+ple(e.args)+`
L168: `+t}import*as Oc from"node:fs";import*as SA from"node:path";import*as Tle from"node:child_process";import*as yle from"node:fs";import*as Ble from"node:url";import*as nc from"node:p...
L169: `}function eHe(e,t){}function l1(e,t,r,n,i,A){let o=A!==void 0?A:eHe;if(e!==void 0)return{TAG:"Ok",_0:{codexBin:e,source:"ExplicitFlag"}};let a=lK(t);if(a!==void 0){let c={};return...
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/index.jsView on unpkg · L167•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 4
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.jsView on unpkg•path = dist/index.js
kind = oversized_source_file
sizeBytes = 4769201
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/index.jsView on unpkgnative/darwin/linzumi-terminal-pty-helperView file
•path = native/darwin/linzumi-terminal-pty-helper
kind = native_binary
sizeBytes = 85160
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
native/darwin/linzumi-terminal-pty-helperView on unpkgdist/assets/ghostty-vt.wasmView file
•path = dist/assets/ghostty-vt.wasm
kind = wasm_module
sizeBytes = 423045
magicHex = [redacted]
Medium
scripts/codex-wire-canary.shView file
•path = scripts/codex-wire-canary.sh
kind = build_helper
sizeBytes = 2427
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
scripts/codex-wire-canary.shView on unpkgFindings
3 Critical12 High8 Medium5 Low
CriticalCredential Exfiltrationdist/cloud-supervisor.mjs
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/topics-cli.mjs
HighShell
HighEvaldist/topics-cli.mjs
HighSame File Env Network Executiondist/topics-cli.mjs
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/topics-cli.mjs
HighCloud Metadata Accessdist/cloud-supervisor.mjs
HighRemote Agent Bridgedist/cloud-supervisor.mjs
HighCross File Remote Execution Contextdist/cloud-supervisor.mjs
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighRuntime Package Installdist/index.js
HighSemantic Analysis Limiteddist/index.js
MediumDynamic Requiredist/cloud-supervisor.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarynative/darwin/linzumi-terminal-pty-helper
MediumShips Wasm Moduledist/assets/ghostty-vt.wasm
MediumShips Build Helperscripts/codex-wire-canary.sh
MediumOversized Source Filedist/index.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/cloud-supervisor.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @linzumi/cli@1.0.311.
The versions list below shows the verdict for each recorded version.
- Avoid installing @linzumi/cli@1.0.311. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
149 known versions1.0.328latestClean—AllowPublishedNov 4, 2026, 11:50 AM1.0.326Clean—AllowPublishedNov 3, 2026, 4:37 PM1.0.323Clean—AllowPublishedNov 2, 2026, 3:19 AM1.0.321Clean—AllowPublishedNov 1, 2026, 3:28 AM1.0.320SuspiciousAI-agent capability abuseWarnPublishedOct 31, 2026, 4:49 PM1.0.319Clean—AllowPublishedOct 31, 2026, 4:26 AM1.0.318SuspiciousCredential ExfiltrationWarnPublishedOct 31, 2026, 12:22 AM1.0.317Clean—AllowPublishedOct 30, 2026, 9:53 PM1.0.316Clean—AllowPublishedOct 30, 2026, 5:01 PM1.0.313Clean—AllowPublishedOct 30, 2026, 9:35 AM1.0.312Clean—AllowPublishedOct 30, 2026, 8:42 AM1.0.311shownMaliciousCredential ExfiltrationBlockPublishedOct 30, 2026, 7:32 AM1.0.310Clean—AllowPublishedOct 30, 2026, 5:39 AM1.0.309Manual Review—AllowUnder ReviewOct 28, 2026, 6:13 PM1.0.308Manual Review—AllowUnder ReviewOct 28, 2026, 7:46 AM1.0.307Manual Review—AllowUnder ReviewOct 28, 2026, 6:27 AM1.0.306Manual Review—AllowUnder ReviewOct 27, 2026, 6:26 PM1.0.305Manual Review—AllowUnder ReviewOct 26, 2026, 5:41 AM1.0.304Clean—AllowPublishedOct 25, 2026, 6:40 AM1.0.303Manual Review—AllowUnder ReviewOct 24, 2026, 1:27 PM1.0.302Clean—AllowPublishedOct 24, 2026, 12:52 PM1.0.301Clean—AllowPublishedOct 24, 2026, 5:54 AM1.0.300Clean—AllowPublishedOct 20, 2026, 7:56 PM1.0.299Manual Review—AllowUnder ReviewOct 20, 2026, 2:42 PM1.0.298Clean—AllowPublishedOct 19, 2026, 8:14 PM1.0.297Clean—AllowPublishedOct 17, 2026, 4:59 AM1.0.296Clean—AllowPublishedOct 13, 2026, 6:06 PM1.0.295Clean—AllowPublishedOct 10, 2026, 8:54 PM1.0.293Clean—AllowPublishedOct 10, 2026, 6:02 PM1.0.292SuspiciousAI-agent capability abuseWarnPublishedOct 7, 2026, 8:49 AM1.0.291Manual Review—AllowUnder ReviewOct 7, 2026, 5:59 AM1.0.290SuspiciousCredential ExfiltrationWarnPublishedOct 7, 2026, 1:40 AM1.0.284Clean—AllowPublishedOct 3, 2026, 10:27 PM1.0.280Scan Failed—AllowUnder ReviewSep 29, 2026, 3:42 PM1.0.279SuspiciousAI-agent capability abuseWarnPublishedSep 29, 2026, 4:15 AM1.0.278SuspiciousAI-agent capability abuseWarnPublishedSep 28, 2026, 9:59 PM1.0.277SuspiciousAI-agent capability abuseWarnPublishedSep 28, 2026, 3:40 AM1.0.276SuspiciousAgent extension lifecycle riskWarnPublishedSep 27, 2026, 8:45 AM1.0.275Clean—AllowPublishedSep 21, 2026, 12:28 PM1.0.273Scan Failed—AllowUnder ReviewSep 17, 2026, 4:38 PM1.0.272SuspiciousAI-agent capability abuseWarnPublishedSep 15, 2026, 7:16 PM1.0.271SuspiciousAI-agent capability abuseWarnPublishedSep 15, 2026, 2:53 PM1.0.268SuspiciousRemote Code ExecutionWarnPublishedSep 14, 2026, 9:55 PM1.0.265SuspiciousAI-agent capability abuseWarnPublishedSep 14, 2026, 5:09 AM1.0.264Suspicious—WarnPublishedSep 13, 2026, 1:34 PM1.0.263SuspiciousCredential ExfiltrationWarnPublishedSep 13, 2026, 12:06 PM1.0.262SuspiciousAI-agent capability abuseWarnPublishedSep 13, 2026, 5:01 AM1.0.261SuspiciousAI-agent capability abuseWarnPublishedSep 12, 2026, 6:28 AM1.0.260SuspiciousRemote Code ExecutionWarnPublishedSep 11, 2026, 6:42 PM1.0.259SuspiciousAI-agent capability abuseWarnPublishedSep 11, 2026, 4:25 PM1.0.258SuspiciousAI-agent capability abuseWarnPublishedSep 11, 2026, 1:35 PM1.0.257SuspiciousAI-agent capability abuseWarnPublishedSep 11, 2026, 9:31 AM1.0.256SuspiciousAI-agent capability abuseWarnPublishedSep 11, 2026, 2:10 AM1.0.254Suspicious—WarnPublishedSep 9, 2026, 10:24 PM1.0.252SuspiciousAI-agent capability abuseWarnPublishedSep 9, 2026, 9:37 AM1.0.251SuspiciousAI-agent capability abuseWarnPublishedSep 9, 2026, 4:16 AM1.0.248SuspiciousAI-agent capability abuseWarnPublishedSep 8, 2026, 9:05 PM1.0.247SuspiciousAI-agent capability abuseWarnPublishedSep 8, 2026, 1:21 PM1.0.246SuspiciousAI-agent capability abuseWarnPublishedSep 8, 2026, 8:25 AM1.0.245SuspiciousAI-agent capability abuseWarnPublishedSep 8, 2026, 2:22 AM1.0.244SuspiciousAI-agent capability abuseWarnPublishedSep 7, 2026, 6:34 AM1.0.239SuspiciousRemote Code ExecutionWarnPublishedSep 5, 2026, 3:03 PM1.0.237Scan Failed—AllowUnder ReviewSep 5, 2026, 10:19 AM1.0.235Clean—AllowPublishedSep 4, 2026, 6:05 PM1.0.234SuspiciousAI-agent capability abuseWarnPublishedAug 22, 2026, 10:50 AM1.0.233Clean—AllowPublishedAug 21, 2026, 10:09 PM1.0.232Clean—AllowPublishedAug 18, 2026, 12:09 PM1.0.231SuspiciousAI-agent capability abuseWarnPublishedAug 18, 2026, 1:36 AM1.0.229Suspicious—WarnPublishedAug 17, 2026, 11:12 AM1.0.226Clean—AllowPublishedAug 15, 2026, 5:08 PM1.0.225Clean—AllowPublishedAug 14, 2026, 5:51 PM1.0.223Clean—AllowPublishedAug 13, 2026, 11:17 PM1.0.222Clean—AllowPublishedAug 13, 2026, 1:24 PM1.0.220Clean—AllowPublishedAug 12, 2026, 8:35 PM1.0.219SuspiciousAI-agent capability abuseWarnPublishedAug 12, 2026, 7:19 PM1.0.218Clean—AllowPublishedAug 12, 2026, 2:21 PM1.0.212Clean—AllowPublishedAug 11, 2026, 8:02 PM1.0.211SuspiciousRemote Code ExecutionWarnPublishedAug 11, 2026, 7:24 PM1.0.210Clean—AllowPublishedAug 11, 2026, 6:56 PM1.0.209Clean—AllowPublishedAug 11, 2026, 11:22 AM1.0.205Clean—AllowPublishedAug 11, 2026, 12:47 AM1.0.204SuspiciousAI-agent capability abuseWarnPublishedAug 5, 2026, 7:19 PM1.0.203Clean—AllowPublishedAug 5, 2026, 8:47 AM1.0.202Clean—AllowPublishedAug 5, 2026, 12:57 AM1.0.191Suspicious—WarnUnder ReviewAug 1, 2026, 2:52 PM1.0.190Suspicious—WarnUnder ReviewAug 1, 2026, 12:23 PM1.0.187Suspicious—WarnUnder ReviewJul 31, 2026, 6:46 AM1.0.180Suspicious—WarnUnder ReviewJul 28, 2026, 9:09 PM1.0.146Suspicious—WarnUnder ReviewJul 20, 2026, 2:51 PM1.0.133Suspicious—WarnUnder ReviewJul 18, 2026, 5:48 AM1.0.132Suspicious—WarnUnder ReviewJul 18, 2026, 5:13 AM1.0.131Suspicious—WarnUnder ReviewJul 18, 2026, 1:37 AM1.0.130Suspicious—WarnUnder ReviewJul 17, 2026, 12:19 AM1.0.129Suspicious—WarnUnder ReviewJul 16, 2026, 6:26 PM1.0.127Suspicious—WarnUnder ReviewJul 16, 2026, 4:27 PM1.0.124Suspicious—WarnUnder ReviewJul 16, 2026, 12:20 PM1.0.123Suspicious—WarnUnder ReviewJul 16, 2026, 9:39 AM1.0.114Suspicious—WarnUnder ReviewJul 14, 2026, 2:00 PM1.0.113SuspiciousAI-agent capability abuseWarnPublishedJul 14, 2026, 1:23 PM1.0.101Suspicious—WarnUnder ReviewJul 13, 2026, 8:31 PM
Showing the 100 most recent of 149 known versions.