registry / @linzumi/cli / 1.0.232
@linzumi/cli@1.0.232
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe malicious scanner findings overstate bundled dependency primitives and an explicit TCP-forwarding feature. Source inspection found no lifecycle hook or concrete malicious execution chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs the linzumi CLI, such as `linzumi start` or `linzumi connect`.
Impact
No install-time execution, credential exfiltration, remote payload execution, or unconsented agent-control mutation was confirmed.
Mechanism
User-invoked local agent runner and loopback TCP forwarding.
AI rationale
The malicious scanner findings overstate bundled dependency primitives and an explicit TCP-forwarding feature. Source inspection found no lifecycle hook or concrete malicious execution chain.
Evidence
package.jsonbin/linzumi.jsdist/tcp-tunnel-cli.mjsREADME.mddist/index.jsdist/impl-ts/index.js
Network endpoints1
serve.linzumi.com
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- No npm preinstall, install, or postinstall hook is declared.
- The executable only imports and invokes the bundled CLI after a user runs `linzumi`.
- The TCP component documents a user-invoked loopback listener; no remote asset decode-and-execute path was found.
Evidence against
- Runtime CLI code uses network, local files, subprocesses, and user-provided credentials for its stated agent-runner functionality.
- The bundle contains an `eval` reference from bundled dependencies, but inspection found no package-controlled remote payload execution.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
17 flaggedscripts/vendor-codex-app-server-protocol.tsView file
13import { fileURLToPath } from 'node:url';
L14: import { spawn } from 'node:child_process';
L15:
High
Child Process
Package source references child process execution.
scripts/vendor-codex-app-server-protocol.tsView on unpkg · L13dist/impl-ts/index.jsView file
27${u}`.split(`
L28: `).filter(c=>c.trim()!=="")}catch{return[]}finally{n!==void 0&&Kpe(n)}}function lfe(e){return e.filter(n=>n.type==="response_item").map(n=>M(n.payload)).filter(n=>n!==void 0).filte...
L29: `,"utf8");let r=new Map,o=0,i={runDir:t,contentMode:e.contentMode,record:(s,a,d={})=>{let u=Rfe(r,t,s);o+=1,u.write(`${JSON.stringify({ts:new Date().toISOString(),mono_ms:Dfe(),seq...
...
L41: `),d)},notices:()=>Array.from(n.values()),reset:()=>n.clear()}}function Tme(e){switch(e){case"warning":return"WARNING: ";case"error":return"ERROR: ";case"info":return""}}function s...
L42: `)}function fz(e){return e.flatMap(n=>n.isImage?[{type:"localImage",path:n.path}]:[])}async function KT(e,n){let t=await BT(e,n),r=JT(n.body,t,{uploadInstructionMode:"footer"}),o=t...
L43: `)}function Bme(
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
Findings
3 Critical12 High6 Medium4 Low
CriticalSame File Env Network Executiondist/impl-ts/index.js
CriticalRemote Asset Decode Executedist/tcp-tunnel-cli.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/impl-ts/index.js
HighChild Processscripts/vendor-codex-app-server-protocol.ts
HighShell
HighEvaldist/impl-ts/index.js
HighCredential Redirect Persistencedist/impl-ts/index.js
HighEntrypoint Foreign Package Code Overwritedist/impl-ts/index.js
HighCommand Output Exfiltrationdist/impl-ts/index.js
HighSandbox Evasion Gated Capabilitydist/impl-ts/index.js
HighCross File Remote Execution Contextdist/impl-res/index.js
Affected versions and remediation
This report applies to @linzumi/cli@1.0.232.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.232 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.