@linzumi/cli@1.0.113
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNot malicious: all observed sensitive behavior is activated by explicit CLI commands and is package-aligned. Warn because it can mutate an AI-agent configuration/control surface and provide MCP capabilities.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs linzumi connect/signup or starts its MCP server.
Impact
A user-approved command can extend Codex with package-provided MCP capabilities and send configured workflow context to its service.
Mechanism
User-invoked Codex configuration and scoped collaboration-agent runner.
AI rationale
Not malicious: all observed sensitive behavior is activated by explicit CLI commands and is package-aligned. Warn because it can mutate an AI-agent configuration/control surface and provide MCP capabilities.
Evidence
package.jsonbin/linzumi.jsdist/index.jsdist/mcp-server.mjsscripts/compute-node-reset-e2e.mjs~/.codex/config.toml~/.linzumi/config.json~/.linzumi/agent-token.json
Network endpoints4
serve.linzumi.comwss://serve.linzumi.comapi.groq.com/openai/v1openrouter.ai/api/v1
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/index.js: wx() writes ~/.codex/config.toml during user-invoked runner setup.
- dist/index.js: connect launches Codex with a Linzumi MCP server and scoped token.
- dist/mcp-server.mjs exposes MCP tools that can read project/thread context and post messages.
- dist/index.js: bundled reconnect summarizer may use configured Groq/OpenRouter API keys.
Evidence against
- package.json has no preinstall/install/postinstall lifecycle hooks.
- bin/linzumi.js only imports and invokes dist/index.js after explicit CLI execution.
- scripts/compute-node-reset-e2e.mjs is a manual localhost E2E test using temporary state.
- mcp config prints configuration to stdout; it does not itself modify Codex/Claude settings.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Source & flagged code
8 flaggeddist/cloud-supervisor.mjsView file
8\r
L9: `+t)}function Q(e,n,t,r,o,s){if(e.listenerCount("wsClientError")){let i=new Error(o);Error.captureStackTrace(i,Q),e.emit("wsClientError",i,t,n)}else be(t,r,o,s)}});import{spawn as ...
L10: `,"utf8")}catch{return}}function Ho(){let e=process.env.LINZUMI_CLI_AUDIT_LOG?.trim();return e===void 0||e===""?It(Rt(),".linzumi","logs","command-events.jsonl"):e}function Zo(e){r...
High
Child Process
Package source references child process execution.
dist/cloud-supervisor.mjsView on unpkg · L82const require = createRequire(import.meta.url);
L3: var dr=Object.create;var Sn=Object.defineProperty;var cr=Object.getOwnPropertyDescriptor;var lr=Object.getOwnPropertyNames;var ur=Object.getPrototypeOf,fr=Object.prototype.hasOwnPr...
L4: `).join(`\r
...
L8: \r
L9: `+t)}function Q(e,n,t,r,o,s){if(e.listenerCount("wsClientError")){let i=new Error(o);Error.captureStackTrace(i,Q),e.emit("wsClientError",i,t,n)}else be(t,r,o,s)}});import{spawn as ...
L10: `,"utf8")}catch{return}}function Ho(){let e=process.env.LINZUMI_CLI_AUDIT_LOG?.trim();return e===void 0||e===""?It(Rt(),".linzumi","logs","command-events.jsonl"):e}function Zo(e){r...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cloud-supervisor.mjsView on unpkg · L2Findings
1 Critical5 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltascripts/compute-node-reset-e2e.mjs
HighChild Processdist/cloud-supervisor.mjs
HighShell
HighSame File Env Network Executiondist/cloud-supervisor.mjs
HighCommand Output Exfiltrationdist/cloud-supervisor.mjs
HighOversized Source Filedist/index.js
MediumDynamic Requirescripts/golden-scale-test.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/qa/codex-keychain-partition-repro.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/mcp-server.mjs
Affected versions and remediation
This report applies to @linzumi/cli@1.0.113.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.113 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.