@linzumi/cli@1.0.258
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThere is no automatic install trigger or confirmed malicious behavior. However, the package provides a high-impact remote-agent and tunnelling capability in opaque bundled code, so a warning is warranted rather than a clean verdict.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user runs a Linzumi command such as connect or a hosted agent workflow.
Impact
A user intentionally granting credentials can expose a selected local TCP service through the package's remote tunnel; the bundled runtime remains difficult to fully audit statically.
Mechanism
User-invoked agent runner with OAuth refresh and authenticated local TCP tunnelling.
AI rationale
There is no automatic install trigger or confirmed malicious behavior. However, the package provides a high-impact remote-agent and tunnelling capability in opaque bundled code, so a warning is warranted rather than a clean verdict.
Evidence
package.jsondist/impl-ts/index.jsdist/tcp-tunnel-cli.mjsdist/impl-res/cloud-supervisor.mjsscripts/vendor-codex-app-server-protocol.ts.linzumi/user-auth.json127.0.0.1
Network endpoints3
auth.openai.com/oauth/tokenwss://linzumi.linkserve.linzumi.com
Decision evidence
public snapshotAI called this Suspicious at 72.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes an executable CLI backed by several very large bundled artifacts, leaving meaningful static-analysis uncertainty.
- The runtime bundle constructs functions dynamically and refreshes an OpenAI OAuth token for hosted agent operation.
- The user-invoked connect command opens an authenticated WebSocket tunnel and listens on a local loopback port.
- A development-only vendor command can clone a configurable source URL and spawn external tools.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The tunnel path is reached only after an explicit CLI connect action and uses an authenticated credential.
- No inspected source showed credential harvesting, stealth persistence, destructive actions, or a decoded remote payload being executed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Source & flagged code
17 flaggedscripts/vendor-codex-app-server-protocol.tsView file
13import { fileURLToPath } from 'node:url';
L14: import { spawn } from 'node:child_process';
L15:
High
Child Process
Package source references child process execution.
scripts/vendor-codex-app-server-protocol.tsView on unpkg · L13dist/impl-ts/index.jsView file
29`,"utf8");let r=new Map,o=0,i={runDir:t,contentMode:e.contentMode,record:(a,s,d={})=>{let u=TCe(r,t,a);o+=1,u.write(`${JSON.stringify({ts:new Date().toISOString(),mono_ms:ECe(),seq...
L30: `,"utf8")},close:async()=>{await Promise.all(Array.from(r.values(),MCe))}};return i.record("commander","debug_trace.started",{run_dir:t,content_mode:e.contentMode}),i}function PJ(e...
L31: GFS4: `),console.error(e)});yr[_o]||(NJ=global[_o]||[],UJ(yr,NJ),yr.close=(function(e){function n(t,r){return e.call(yr,t,function(o){o||zJ(),typeof r=="function"&&r.apply(this,arg...
L32: `);return}}},t={contents:"Accepting"},r={contents:void 0},o=()=>{let i=t.contents;if(typeof i!="object")return;let a=i._0,s;try{s={TAG:"Ok",_0:e.isQuiescent()}}catch(u){let c=Qt(u)...
L33: `}:{TAG:"Error",_0:{message:"coding acc
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
Findings
3 Critical11 High7 Medium4 Low
CriticalSame File Env Network Executiondist/impl-ts/index.js
CriticalRemote Asset Decode Executedist/tcp-tunnel-cli.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/impl-ts/index.js
HighChild Processscripts/vendor-codex-app-server-protocol.ts
HighShell
HighEvaldist/impl-ts/index.js
HighCredential Redirect Persistencedist/impl-ts/index.js
HighCommand Output Exfiltrationdist/impl-ts/index.js
HighSandbox Evasion Gated Capabilitydist/impl-ts/index.js
HighCross File Remote Execution Contextdist/impl-res/cloud-supervisor.mjs
HighTrigger Reachable Command Output Exfiltrationdist/impl-ts/index.js
Affected versions and remediation
This report applies to @linzumi/cli@1.0.258.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.258 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.