@linzumi/cli@1.0.246
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe scanner's remote-decode claim was not confirmed: the inspected dynamic evaluation is bundled dependency code and the tunnel is an explicit feature. The package remains a risky agent-control tool because authenticated remote sessions can drive broad local actions.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the CLI, authenticates it, and starts an agent runner or connect command.
Impact
A compromised or overly trusted Linzumi account or service could direct powerful local agent actions and expose an approved TCP forward.
Mechanism
Authenticated remote agent control and loopback TCP forwarding.
AI rationale
The scanner's remote-decode claim was not confirmed: the inspected dynamic evaluation is bundled dependency code and the tunnel is an explicit feature. The package remains a risky agent-control tool because authenticated remote sessions can drive broad local actions.
Evidence
package.jsonbin/linzumi.jsdist/impl-ts/index.jsdist/impl-ts/tcp-tunnel-cli.mjs~/.linzumi/user-auth.json
Network endpoints2
serve.linzumi.comlinzumi.link
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package ships an executable CLI that loads its bundled runtime.
- The bundled CLI exposes authenticated TCP forwarding to a Linzumi service.
- The runtime is an agent runner with broad local command and service-management capabilities.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The forwarding feature is activated only through an explicit CLI command and supports a loopback listener.
- The observed Function calls are bundled schema-validator internals; no remote payload-to-eval chain was confirmed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
17 flaggedscripts/vendor-codex-app-server-protocol.tsView file
13import { fileURLToPath } from 'node:url';
L14: import { spawn } from 'node:child_process';
L15:
High
Child Process
Package source references child process execution.
scripts/vendor-codex-app-server-protocol.tsView on unpkg · L13dist/impl-ts/index.jsView file
27${u}`.split(`
L28: `).filter(c=>c.trim()!=="")}catch{return[]}finally{n!==void 0&&dbe(n)}}function Pbe(e){return e.filter(n=>n.type==="response_item").map(n=>M(n.payload)).filter(n=>n!==void 0).filte...
L29: `,"utf8");let r=new Map,o=0,i={runDir:t,contentMode:e.contentMode,record:(a,s,d={})=>{let u=Vbe(r,t,a);o+=1,u.write(`${JSON.stringify({ts:new Date().toISOString(),mono_ms:Zbe(),seq...
...
L41: `),d)},notices:()=>Array.from(n.values()),reset:()=>n.clear()}}function Bxe(e){switch(e){case"warning":return"WARNING: ";case"error":return"ERROR: ";case"info":return""}}function v...
L42: `)}function P8(e){return e.flatMap(n=>n.isImage?[{type:"localImage",path:n.path}]:[])}async function rE(e,n){let t=await nE(e,n),r=tE(n.body,t,{uploadInstructionMode:"footer"}),o=t...
L43: `)}function ave(
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
Findings
3 Critical11 High7 Medium4 Low
CriticalSame File Env Network Executiondist/impl-ts/index.js
CriticalRemote Asset Decode Executedist/tcp-tunnel-cli.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/impl-ts/index.js
HighChild Processscripts/vendor-codex-app-server-protocol.ts
HighShell
HighEvaldist/impl-ts/index.js
HighCredential Redirect Persistencedist/impl-ts/index.js
HighCommand Output Exfiltrationdist/impl-ts/index.js
HighSandbox Evasion Gated Capabilitydist/impl-ts/index.js
HighCross File Remote Execution Contextdist/impl-res/cloud-supervisor.mjs
HighTrigger Reachable Command Output Exfiltrationdist/impl-ts/index.js
Affected versions and remediation
This report applies to @linzumi/cli@1.0.246.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.246 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.