registry / @linzumi/cli / 1.0.209
@linzumi/cli@1.0.209
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection found documented, user-triggered agent and MCP functionality but no lifecycle hook, credential exfiltration, remote payload execution, or stealth persistence. Scanner eval and remote-decode signals resolve to bundled validation code and normal base64/OAuth handling.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs linzumi commands such as signup, connect, start, or mcp server.
Impact
User-authorized commands can run coding-agent workflows in configured trusted folders.
Mechanism
Authenticated local-agent runner and vendor API client
AI rationale
Source inspection found documented, user-triggered agent and MCP functionality but no lifecycle hook, credential exfiltration, remote payload execution, or stealth persistence. Scanner eval and remote-decode signals resolve to bundled validation code and normal base64/OAuth handling.
Evidence
package.jsonREADME.mdbin/linzumi.jsdist/index.jsdist/impl-ts/index.jsdist/impl-res/index.js~/.linzumi/config.json
Network endpoints2
serve.linzumi.comwss://serve.linzumi.com
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- User-invoked CLI can start local Codex/Claude workflows and connect to Linzumi.
- Runtime sends opt-out telemetry to the vendor endpoint.
Evidence against
- package.json has no preinstall/install/postinstall hooks.
- bin/linzumi.js only imports dist/index.js after explicit CLI execution.
- dist/index.js telemetry posts service/platform metadata, not environment credentials.
- dist/impl-ts/index.js uses OAuth/device tokens only for configured Linzumi APIs.
- The sole eval/new Function matches are bundled AJV schema-code generation.
- README.md documents trusted-folder, explicit-runner, and MCP setup flows.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
17 flaggeddist/impl-res/cloud-supervisor.mjsView file
8\r
L9: `+t)}function ee(e,n,t,r,o,i){if(e.listenerCount("wsClientError")){let s=new Error(o);Error.captureStackTrace(s,ee),e.emit("wsClientError",s,t,n)}else Te(t,r,o,i)}});import{spawn a...
L10: `,"utf8")}catch{return}}function Ni(){let e=process.env.LINZUMI_CLI_AUDIT_LOG?.trim();return e===void 0||e===""?sr(ir(),".linzumi","logs","command-events.jsonl"):e}function Ji(e){r...
High
Child Process
Package source references child process execution.
dist/impl-res/cloud-supervisor.mjsView on unpkg · L82const require = __linzumiBundleCreateRequire(import.meta.url);
L3: var Hr=Object.create;var Kn=Object.defineProperty;var Kr=Object.getOwnPropertyDescriptor;var Qr=Object.getOwnPropertyNames;var Zr=Object.getPrototypeOf,Xr=Object.prototype.hasOwnPr...
L4: `).join(`\r
...
L8: \r
L9: `+t)}function ee(e,n,t,r,o,i){if(e.listenerCount("wsClientError")){let s=new Error(o);Error.captureStackTrace(s,ee),e.emit("wsClientError",s,t,n)}else Te(t,r,o,i)}});import{spawn a...
L10: `,"utf8")}catch{return}}function Ni(){let e=process.env.LINZUMI_CLI_AUDIT_LOG?.trim();return e===void 0||e===""?sr(ir(),".linzumi","logs","command-events.jsonl"):e}function Ji(e){r...
L11: `,"utf8")}function xr(){let e=process.env.LINZUMI_AGENT_REPLAY_RECORD_FILE?.trim();return e===void 0||e===""?void 0:e}function Zi(e){ret
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/impl-res/cloud-supervisor.mjsFindings
3 Critical12 High6 Medium4 Low
CriticalSame File Env Network Executiondist/impl-ts/index.js
CriticalRemote Asset Decode Executedist/impl-res/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/impl-ts/index.js
HighChild Processdist/impl-res/cloud-supervisor.mjs
HighShell
HighEvaldist/impl-res/index.js
HighCredential Redirect Persistencedist/impl-ts/index.js
HighEntrypoint Foreign Package Code Overwritedist/impl-ts/index.js
HighCommand Output Exfiltrationdist/impl-res/cloud-supervisor.mjs
HighSandbox Evasion Gated Capabilitydist/impl-ts/index.js
HighRemote Agent Bridgedist/impl-res/index.js
Affected versions and remediation
This report applies to @linzumi/cli@1.0.209.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.209 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.