@linzumi/cli@1.0.204
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package is not malicious by static source evidence, but its intentional remote orchestration and agent-launch capability warrants a warning classification. No unconsented lifecycle mutation, credential exfiltration chain, or remote decoded-payload execution was confirmed.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs linzumi start/connect/signup or explicit mcp config.
Impact
A compromised or over-permissioned Linzumi account/service could direct an agent with access to the user's selected workspace.
Mechanism
Remote agent orchestration with local process spawning and verified runtime installation.
AI rationale
The package is not malicious by static source evidence, but its intentional remote orchestration and agent-launch capability warrants a warning classification. No unconsented lifecycle mutation, credential exfiltration chain, or remote decoded-payload execution was confirmed.
Evidence
package.jsonbin/linzumi.jsdist/index.jsdist/impl-ts/index.jsREADME.md~/.linzumi/config.json~/.linzumi/editor-runtimes~/.linzumi/codex-home/config.toml
Network endpoints3
serve.linzumi.com/api/v2/local-codex-runner/editor-runtime/{platform}/manifest/api/v1/observability/logs
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Runtime accepts remote Linzumi commands and starts local Codex/Claude agent processes.
- Downloads and extracts a server-managed editor runtime after SHA-256 validation.
- Writes runner state, logs, and isolated Codex configuration under ~/.linzumi.
- Explicit mcp config supports Codex and Claude Code configuration.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- bin/linzumi.js only loads dist/index.js when the user invokes the CLI.
- Remote runtime download is authenticated where same-origin and checksum-verified.
- new Function/eval-like hits are bundled AJV schema-validation code, not fetched payload execution.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinified
Source & flagged code
13 flaggeddist/impl-res/cloud-supervisor.mjsView file
8\r
L9: `+t)}function Y(e,n,t,r,o,s){if(e.listenerCount("wsClientError")){let i=new Error(o);Error.captureStackTrace(i,Y),e.emit("wsClientError",i,t,n)}else be(t,r,o,s)}});import{spawn as ...
L10: `,"utf8")}catch{return}}function as(){let e=process.env.LINZUMI_CLI_AUDIT_LOG?.trim();return e===void 0||e===""?$t(Jt(),".linzumi","logs","command-events.jsonl"):e}function ds(e){r...
High
Child Process
Package source references child process execution.
dist/impl-res/cloud-supervisor.mjsView on unpkg · L82const require = __linzumiBundleCreateRequire(import.meta.url);
L3: var br=Object.create;var Pn=Object.defineProperty;var vr=Object.getOwnPropertyDescriptor;var Sr=Object.getOwnPropertyNames;var wr=Object.getPrototypeOf,kr=Object.prototype.hasOwnPr...
L4: `).join(`\r
...
L8: \r
L9: `+t)}function Y(e,n,t,r,o,s){if(e.listenerCount("wsClientError")){let i=new Error(o);Error.captureStackTrace(i,Y),e.emit("wsClientError",i,t,n)}else be(t,r,o,s)}});import{spawn as ...
L10: `,"utf8")}catch{return}}function as(){let e=process.env.LINZUMI_CLI_AUDIT_LOG?.trim();return e===void 0||e===""?$t(Jt(),".linzumi","logs","command-events.jsonl"):e}function ds(e){r...
...
L12: `);function er(){return["-c",'mcp_oauth_credentials_store="file"',"-c",'cli_auth_credentials_store="file"']}var Cs=5*6e4;var Ts=(()=
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/impl-res/cloud-supervisor.mjsFindings
3 Critical8 High6 Medium4 Low
CriticalSame File Env Network Executiondist/impl-ts/index.js
CriticalRemote Asset Decode Executedist/impl-res/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/impl-ts/index.js
HighChild Processdist/impl-res/cloud-supervisor.mjs
HighShell
HighEvaldist/impl-res/index.js
HighCommand Output Exfiltrationdist/impl-res/cloud-supervisor.mjs
HighSandbox Evasion Gated Capabilitydist/impl-ts/index.js
HighCross File Remote Execution Contextdist/impl-ts/index.js
HighTrigger Reachable Command Output Exfiltrationdist/impl-ts/index.js
HighTrigger Reachable Persistencedist/impl-ts/index.js
Affected versions and remediation
This report applies to @linzumi/cli@1.0.204.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.204 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.