registry / @linzumi/cli / 1.0.130
@linzumi/cli@1.0.130
⚠ Under reviewLinzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
dist/impl-ts/index.js2.16 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsWebSocketHighEntropyStringsUrlStrings127.0.0.1app.linzumi.comcdn.example.com
Source & flagged code
8 flaggeddist/impl-res/cloud-supervisor.mjsView file
8\r
L9: `+t)}function Q(e,n,t,r,o,s){if(e.listenerCount("wsClientError")){let i=new Error(o);Error.captureStackTrace(i,Q),e.emit("wsClientError",i,t,n)}else be(t,r,o,s)}});import{spawn as ...
L10: `,"utf8")}catch{return}}function Zo(){let e=process.env.LINZUMI_CLI_AUDIT_LOG?.trim();return e===void 0||e===""?Mt(It(),".linzumi","logs","command-events.jsonl"):e}function Xo(e){r...
High
Child Process
Package source references child process execution.
dist/impl-res/cloud-supervisor.mjsView on unpkg · L82const require = createRequire(import.meta.url);
L3: var cr=Object.create;var Sn=Object.defineProperty;var lr=Object.getOwnPropertyDescriptor;var ur=Object.getOwnPropertyNames;var fr=Object.getPrototypeOf,pr=Object.prototype.hasOwnPr...
L4: `).join(`\r
...
L8: \r
L9: `+t)}function Q(e,n,t,r,o,s){if(e.listenerCount("wsClientError")){let i=new Error(o);Error.captureStackTrace(i,Q),e.emit("wsClientError",i,t,n)}else be(t,r,o,s)}});import{spawn as ...
L10: `,"utf8")}catch{return}}function Zo(){let e=process.env.LINZUMI_CLI_AUDIT_LOG?.trim();return e===void 0||e===""?Mt(It(),".linzumi","logs","command-events.jsonl"):e}function Xo(e){r...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/impl-res/cloud-supervisor.mjsView on unpkg · L2Findings
1 Critical5 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltascripts/compute-node-reset-e2e.mjs
HighChild Processdist/impl-res/cloud-supervisor.mjs
HighShell
HighSame File Env Network Executiondist/impl-res/cloud-supervisor.mjs
HighCommand Output Exfiltrationdist/impl-res/cloud-supervisor.mjs
HighOversized Source Filedist/impl-ts/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/qa/codex-keychain-partition-repro.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/impl-res/index.js
Affected versions and remediation
This report applies to @linzumi/cli@1.0.130.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.130 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.