@linzumi/cli@1.0.252
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malware chain or install-time abuse was found. However, the package provides high-impact agent-controlled file upload and credential-handling capabilities, leaving a real misuse risk.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user starts a Linzumi cloud or agent session and the workflow invokes attachment or hosted-auth handling.
Impact
A compromised or over-privileged agent session could expose files within the allowed upload roots or provider credentials to the configured Linzumi service.
Mechanism
Agent-directed local-file upload and hosted coding-agent orchestration.
AI rationale
No concrete malware chain or install-time abuse was found. However, the package provides high-impact agent-controlled file upload and credential-handling capabilities, leaving a real misuse risk.
Evidence
dist/impl-ts/index.jsdist/impl-res/cloud-supervisor.mjsdist/tcp-tunnel-cli.mjs.kandan~/Downloads~/.linzumi/user-auth.json
Network endpoints2
serve.linzumi.comlinzumi.link
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI contains an agent-response attachment path that reads permitted local files and uploads their contents to server-provided URLs.
- The cloud supervisor launches Codex with a dedicated home directory and handles device-auth credentials and callbacks.
- The package exposes a TCP tunnel client that sends bearer credentials to Linzumi endpoints.
- The published manifest has no npm preinstall, install, or postinstall hook, so the observed capabilities are not automatically activated at installation.
Evidence against
- No install lifecycle script or self-dependency is present in package.json.
- The inspected attachment code restricts uploads to the runner directory or Downloads and rejects hidden path segments.
- The reported base64 and dynamic-require constructs in the tunnel bundle are bundled dependency/runtime code; no remote payload evaluation was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem
Source & flagged code
18 flaggedscripts/vendor-codex-app-server-protocol.tsView file
13import { fileURLToPath } from 'node:url';
L14: import { spawn } from 'node:child_process';
L15:
High
Child Process
Package source references child process execution.
scripts/vendor-codex-app-server-protocol.tsView on unpkg · L13dist/impl-ts/index.jsView file
27${u}`.split(`
L28: `).filter(c=>c.trim()!=="")}catch{return[]}finally{n!==void 0&&Bbe(n)}}function uxe(e){return e.filter(n=>n.type==="response_item").map(n=>O(n.payload)).filter(n=>n!==void 0).filte...
L29: `,"utf8");let r=new Map,o=0,i={runDir:t,contentMode:e.contentMode,record:(a,s,d={})=>{let u=Ixe(r,t,a);o+=1,u.write(`${JSON.stringify({ts:new Date().toISOString(),mono_ms:Axe(),seq...
...
L41: `),d)},notices:()=>Array.from(n.values()),reset:()=>n.clear()}}function kve(e){switch(e){case"warning":return"WARNING: ";case"error":return"ERROR: ";case"info":return""}}function U...
L42: `)}function H8(e){return e.flatMap(n=>n.isImage?[{type:"localImage",path:n.path}]:[])}async function kE(e,n){let t=await wE(e,n),r=SE(n.body,t,{uploadInstructionMode:"footer"}),o=t...
L43: `)}function zve(
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
Findings
4 Critical11 High7 Medium4 Low
CriticalSame File Env Network Executiondist/impl-ts/index.js
CriticalRemote Asset Decode Executedist/tcp-tunnel-cli.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/impl-ts/index.js
CriticalPrevious Version Dangerous Deltadist/impl-res/mcp-server.mjs
HighChild Processscripts/vendor-codex-app-server-protocol.ts
HighShell
HighEvaldist/impl-ts/index.js
HighCredential Redirect Persistencedist/impl-ts/index.js
HighCommand Output Exfiltrationdist/impl-ts/index.js
HighSandbox Evasion Gated Capabilitydist/impl-ts/index.js
HighCross File Remote Execution Contextdist/impl-res/cloud-supervisor.mjs
Affected versions and remediation
This report applies to @linzumi/cli@1.0.252.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.252 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.