registry / @linzumi/cli / 1.0.220
@linzumi/cli@1.0.220
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect inspection found a user-invoked remote-agent CLI with expected network, process, and local-agent integration behavior, but no lifecycle hook or concrete unconsented credential theft, payload execution, persistence, or foreign AI-agent control-surface mutation. The scanner's evaluation finding is attributable to bundled validator code.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs linzumi signup, connect, start, or another CLI command.
Impact
Can access selected/trusted project and agent-session data as part of the requested runner workflow.
Mechanism
User-authorized local agent runner and service connection.
AI rationale
Direct inspection found a user-invoked remote-agent CLI with expected network, process, and local-agent integration behavior, but no lifecycle hook or concrete unconsented credential theft, payload execution, persistence, or foreign AI-agent control-surface mutation. The scanner's evaluation finding is attributable to bundled validator code.
Evidence
package.jsonbin/linzumi.jsdist/index.jsdist/impl-ts/index.jsREADME.md~/.linzumi/config.json~/.linzumi/auth.json
Network endpoints2
serve.linzumi.comwss://serve.linzumi.com
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- User-invoked CLI launches its bundled main module.
- The documented runtime starts Codex only in trusted folders.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- No remote payload decoding and execution was confirmed; new Function is bundled schema-validator code.
- Network use is Linzumi service/auth/telemetry functionality invoked by CLI commands.
- Codex/Claude local-data access supports the stated interactive runner workflow, not install-time harvesting.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
18 flaggeddist/impl-res/cloud-supervisor.mjsView file
8\r
L9: `+t)}function ee(e,n,t,r,o,i){if(e.listenerCount("wsClientError")){let s=new Error(o);Error.captureStackTrace(s,ee),e.emit("wsClientError",s,t,n)}else Te(t,r,o,i)}});import{spawn a...
L10: `,"utf8")}catch{return}}function Ni(){let e=process.env.LINZUMI_CLI_AUDIT_LOG?.trim();return e===void 0||e===""?sr(ir(),".linzumi","logs","command-events.jsonl"):e}function Ji(e){r...
High
Child Process
Package source references child process execution.
dist/impl-res/cloud-supervisor.mjsView on unpkg · L82const require = __linzumiBundleCreateRequire(import.meta.url);
L3: var Hr=Object.create;var Kn=Object.defineProperty;var Kr=Object.getOwnPropertyDescriptor;var Qr=Object.getOwnPropertyNames;var Zr=Object.getPrototypeOf,Xr=Object.prototype.hasOwnPr...
L4: `).join(`\r
...
L8: \r
L9: `+t)}function ee(e,n,t,r,o,i){if(e.listenerCount("wsClientError")){let s=new Error(o);Error.captureStackTrace(s,ee),e.emit("wsClientError",s,t,n)}else Te(t,r,o,i)}});import{spawn a...
L10: `,"utf8")}catch{return}}function Ni(){let e=process.env.LINZUMI_CLI_AUDIT_LOG?.trim();return e===void 0||e===""?sr(ir(),".linzumi","logs","command-events.jsonl"):e}function Ji(e){r...
L11: `,"utf8")}function xr(){let e=process.env.LINZUMI_AGENT_REPLAY_RECORD_FILE?.trim();return e===void 0||e===""?void 0:e}function Zi(e){ret
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/impl-res/cloud-supervisor.mjsFindings
3 Critical13 High6 Medium4 Low
CriticalSame File Env Network Executiondist/impl-ts/index.js
CriticalRemote Asset Decode Executedist/impl-ts/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/impl-ts/index.js
HighChild Processdist/impl-res/cloud-supervisor.mjs
HighShell
HighEvaldist/impl-res/index.js
HighCredential Redirect Persistencedist/impl-ts/index.js
HighEntrypoint Foreign Package Code Overwritedist/impl-ts/index.js
HighCommand Output Exfiltrationdist/impl-res/cloud-supervisor.mjs
HighSandbox Evasion Gated Capabilitydist/impl-ts/index.js
HighRemote Agent Bridgedist/impl-res/index.js
Affected versions and remediation
This report applies to @linzumi/cli@1.0.220.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.220 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.