registry / @linzumi/cli / 1.0.202
@linzumi/cli@1.0.202
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner's evaluation finding is attributable to bundled AJV, and the remaining process/network behavior implements the documented user-invoked local agent runner. No install-time execution or concrete malicious chain was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Explicit execution of linzumi commands such as connect, start, or signup.
Impact
User-authorized agent processes may access selected trusted project folders.
Mechanism
Local AI-runner orchestration with authenticated service communication.
AI rationale
The scanner's evaluation finding is attributable to bundled AJV, and the remaining process/network behavior implements the documented user-invoked local agent runner. No install-time execution or concrete malicious chain was found.
Evidence
package.jsonbin/linzumi.jsdist/index.jsdist/impl-ts/index.jsdist/impl-res/index.js
Network endpoints1
serve.linzumi.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- No install lifecycle hooks in package.json.
- dist/impl-res/index.js uses new Function only in bundled AJV schema compilation.
- CLI can launch local Codex/Claude processes and connect to Linzumi services after an explicit command.
Evidence against
- bin/linzumi.js only imports and runs the CLI entrypoint.
- Network/auth flows target configured or default Linzumi endpoints.
- dist/impl-ts/index.js uses isolated Linzumi CODEX_HOME for spawned Codex sessions.
- No source evidence of covert credential harvesting, remote payload execution, or destructive install behavior.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
14 flaggeddist/impl-res/cloud-supervisor.mjsView file
8\r
L9: `+t)}function Y(e,n,t,r,o,s){if(e.listenerCount("wsClientError")){let i=new Error(o);Error.captureStackTrace(i,Y),e.emit("wsClientError",i,t,n)}else be(t,r,o,s)}});import{spawn as ...
L10: `,"utf8")}catch{return}}function as(){let e=process.env.LINZUMI_CLI_AUDIT_LOG?.trim();return e===void 0||e===""?$t(Jt(),".linzumi","logs","command-events.jsonl"):e}function ds(e){r...
High
Child Process
Package source references child process execution.
dist/impl-res/cloud-supervisor.mjsView on unpkg · L82const require = __linzumiBundleCreateRequire(import.meta.url);
L3: var br=Object.create;var Pn=Object.defineProperty;var vr=Object.getOwnPropertyDescriptor;var Sr=Object.getOwnPropertyNames;var wr=Object.getPrototypeOf,kr=Object.prototype.hasOwnPr...
L4: `).join(`\r
...
L8: \r
L9: `+t)}function Y(e,n,t,r,o,s){if(e.listenerCount("wsClientError")){let i=new Error(o);Error.captureStackTrace(i,Y),e.emit("wsClientError",i,t,n)}else be(t,r,o,s)}});import{spawn as ...
L10: `,"utf8")}catch{return}}function as(){let e=process.env.LINZUMI_CLI_AUDIT_LOG?.trim();return e===void 0||e===""?$t(Jt(),".linzumi","logs","command-events.jsonl"):e}function ds(e){r...
...
L12: `);function er(){return["-c",'mcp_oauth_credentials_store="file"',"-c",'cli_auth_credentials_store="file"']}var Cs=5*6e4;var Ts=(()=
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/impl-res/cloud-supervisor.mjsFindings
3 Critical9 High6 Medium4 Low
CriticalSame File Env Network Executiondist/impl-ts/index.js
CriticalRemote Asset Decode Executedist/impl-res/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/impl-ts/index.js
HighChild Processdist/impl-res/cloud-supervisor.mjs
HighShell
HighEvaldist/impl-res/index.js
HighCommand Output Exfiltrationdist/impl-res/cloud-supervisor.mjs
HighSandbox Evasion Gated Capabilitydist/impl-ts/index.js
HighCross File Remote Execution Contextdist/impl-ts/index.js
HighTrigger Reachable Command Output Exfiltrationdist/impl-ts/index.js
HighTrigger Reachable Persistencedist/impl-ts/index.js
Affected versions and remediation
This report applies to @linzumi/cli@1.0.202.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.202 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.