@linzumi/cli@1.0.248
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malicious install hook, payload execution, exfiltration, or persistence was confirmed. The package still exposes a high-impact remote AI-agent control capability, so it warrants a warning rather than a clean verdict.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the linzumi CLI and configures or starts a local runner.
Impact
A compromised or misused Linzumi account or service could direct agent activity in folders the user has trusted.
Mechanism
Remote orchestration of locally running Codex agents.
AI rationale
No concrete malicious install hook, payload execution, exfiltration, or persistence was confirmed. The package still exposes a high-impact remote AI-agent control capability, so it warrants a warning rather than a clean verdict.
Evidence
README.mdpackage.jsonbin/linzumi.jsdist/index.js~/.linzumi/config.json
Network endpoints1
serve.linzumi.com
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package provides remote management of local Codex agents, a dangerous capability that can execute work on a user's machine after explicit setup.
- It includes the Codex SDK and networking libraries needed for an agent-control client.
- The command entrypoint imports and runs the bundled implementation with user-supplied arguments.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
- The package does not depend on its own package name.
- The claimed remote-payload execution was not confirmed in the inspected tunnel implementation; it implements an authenticated WebSocket tunnel.
- No automatic credential theft, destructive action, or install-time persistence was confirmed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Source & flagged code
17 flaggedscripts/vendor-codex-app-server-protocol.tsView file
13import { fileURLToPath } from 'node:url';
L14: import { spawn } from 'node:child_process';
L15:
High
Child Process
Package source references child process execution.
scripts/vendor-codex-app-server-protocol.tsView on unpkg · L13dist/impl-ts/index.jsView file
27${u}`.split(`
L28: `).filter(c=>c.trim()!=="")}catch{return[]}finally{n!==void 0&&Bbe(n)}}function uxe(e){return e.filter(n=>n.type==="response_item").map(n=>O(n.payload)).filter(n=>n!==void 0).filte...
L29: `,"utf8");let r=new Map,o=0,i={runDir:t,contentMode:e.contentMode,record:(a,s,d={})=>{let u=Ixe(r,t,a);o+=1,u.write(`${JSON.stringify({ts:new Date().toISOString(),mono_ms:Axe(),seq...
...
L41: `),d)},notices:()=>Array.from(n.values()),reset:()=>n.clear()}}function kve(e){switch(e){case"warning":return"WARNING: ";case"error":return"ERROR: ";case"info":return""}}function U...
L42: `)}function H8(e){return e.flatMap(n=>n.isImage?[{type:"localImage",path:n.path}]:[])}async function kE(e,n){let t=await wE(e,n),r=SE(n.body,t,{uploadInstructionMode:"footer"}),o=t...
L43: `)}function zve(
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
Findings
3 Critical11 High7 Medium4 Low
CriticalSame File Env Network Executiondist/impl-ts/index.js
CriticalRemote Asset Decode Executedist/tcp-tunnel-cli.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/impl-ts/index.js
HighChild Processscripts/vendor-codex-app-server-protocol.ts
HighShell
HighEvaldist/impl-ts/index.js
HighCredential Redirect Persistencedist/impl-ts/index.js
HighCommand Output Exfiltrationdist/impl-ts/index.js
HighSandbox Evasion Gated Capabilitydist/impl-ts/index.js
HighCross File Remote Execution Contextdist/impl-res/cloud-supervisor.mjs
HighTrigger Reachable Command Output Exfiltrationdist/impl-ts/index.js
Affected versions and remediation
This report applies to @linzumi/cli@1.0.248.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.248 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.