registry / @linzumi/cli / 1.0.233
@linzumi/cli@1.0.233
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiStatic hints overstate bundled dependency primitives: the observed new Function is schema compilation, and the tunnel artifact contains bundled networking code. The reviewed package has no lifecycle hooks and its sensitive capabilities are activated through explicit CLI use.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Explicit execution of the linzumi CLI
Impact
User-authorized agent execution in configured trusted folders; no unconsented compromise confirmed.
Mechanism
Runs a configured local Codex/agent runner and connects to Linzumi services
AI rationale
Static hints overstate bundled dependency primitives: the observed new Function is schema compilation, and the tunnel artifact contains bundled networking code. The reviewed package has no lifecycle hooks and its sensitive capabilities are activated through explicit CLI use.
Evidence
package.jsonbin/linzumi.jsREADME.mddist/index.jsdist/impl-ts/index.jsdist/tcp-tunnel-cli.mjsscripts/vendor-codex-app-server-protocol.ts
Network endpoints1
serve.linzumi.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- User-invoked CLI starts a local agent runner that communicates with Linzumi services.
- Bundled schema-validation code uses new Function; no remote payload is fetched or executed by that code.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The bin only imports the packaged main module after the user runs linzumi.
- README documents local runner/authentication behavior and trusted-folder operation.
- No credential exfiltration, covert persistence, destructive action, or unconsented foreign AI-agent control-surface mutation was confirmed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
17 flaggedscripts/vendor-codex-app-server-protocol.tsView file
13import { fileURLToPath } from 'node:url';
L14: import { spawn } from 'node:child_process';
L15:
High
Child Process
Package source references child process execution.
scripts/vendor-codex-app-server-protocol.tsView on unpkg · L13dist/impl-ts/index.jsView file
27${u}`.split(`
L28: `).filter(c=>c.trim()!=="")}catch{return[]}finally{n!==void 0&&Ype(n)}}function xfe(e){return e.filter(n=>n.type==="response_item").map(n=>M(n.payload)).filter(n=>n!==void 0).filte...
L29: `,"utf8");let r=new Map,o=0,i={runDir:t,contentMode:e.contentMode,record:(s,a,d={})=>{let u=Ffe(r,t,s);o+=1,u.write(`${JSON.stringify({ts:new Date().toISOString(),mono_ms:zfe(),seq...
...
L41: `),d)},notices:()=>Array.from(n.values()),reset:()=>n.clear()}}function Ome(e){switch(e){case"warning":return"WARNING: ";case"error":return"ERROR: ";case"info":return""}}function p...
L42: `)}function xz(e){return e.flatMap(n=>n.isImage?[{type:"localImage",path:n.path}]:[])}async function XT(e,n){let t=await ZT(e,n),r=QT(n.body,t,{uploadInstructionMode:"footer"}),o=t...
L43: `)}function Qme(
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
Findings
3 Critical12 High6 Medium4 Low
CriticalSame File Env Network Executiondist/impl-ts/index.js
CriticalRemote Asset Decode Executedist/tcp-tunnel-cli.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/impl-ts/index.js
HighChild Processscripts/vendor-codex-app-server-protocol.ts
HighShell
HighEvaldist/impl-ts/index.js
HighCredential Redirect Persistencedist/impl-ts/index.js
HighEntrypoint Foreign Package Code Overwritedist/impl-ts/index.js
HighCommand Output Exfiltrationdist/impl-ts/index.js
HighSandbox Evasion Gated Capabilitydist/impl-ts/index.js
HighCross File Remote Execution Contextdist/impl-res/index.js
Affected versions and remediation
This report applies to @linzumi/cli@1.0.233.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.233 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.