@linzumi/cli@1.0.261
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has dangerous agent and credential-handling capabilities but they are reached through explicit CLI commands, not npm lifecycle hooks. Static inspection does not establish covert exfiltration or an automatic malicious chain.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the hosted coding-account authorization or connect command.
Impact
A user who invokes these features permits the package to handle coding-agent credentials and create a network-connected tunnel.
Mechanism
Credential relay and authenticated remote tunnel creation.
AI rationale
The package has dangerous agent and credential-handling capabilities but they are reached through explicit CLI commands, not npm lifecycle hooks. Static inspection does not establish covert exfiltration or an automatic malicious chain.
Evidence
dist/impl-ts/index.jsdist/impl-res/cloud-supervisor.mjsdist/tcp-tunnel-cli.mjs.credentials.json.claude.jsonauth.json.linzumi/user-auth.json
Network endpoints2
serve.linzumi.comlinzumi.link
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI exposes an explicit hosted coding-account authorization command.
- Its cloud supervisor reads Codex or Claude credential files and posts results to a callback URL supplied through environment variables.
- The CLI provides authenticated TCP tunnelling to Linzumi endpoints.
- Hosted authorization workers are configured with open network access.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The published executable imports the main program only when the user runs the linzumi command.
- The observed network hosts are Linzumi service endpoints, not an unrelated payload host.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
18 flaggedscripts/vendor-codex-app-server-protocol.tsView file
13import { fileURLToPath } from 'node:url';
L14: import { spawn } from 'node:child_process';
L15:
High
Child Process
Package source references child process execution.
scripts/vendor-codex-app-server-protocol.tsView on unpkg · L13dist/impl-ts/index.jsView file
35`),g=f.path,m=`
L36: - `+(g===""?"":"At "+g+": ")+p;u[m]||(u[m]=1,s=s+m)}}let d={code:"invalid_input",path:t,reason:s,expected:e,received:n,unionErrors:i};return o&&(d.input=r),d}function Tk(e,n,t,r){r...
L37: `}:{TAG:"Error",_0:{message:"coding account admission failure state was not serializable"}}}catch{return{TAG:"Error",_0:{message:"coding account admission failure state serializati...
L38: `)}function Ns(e,n="inner"){if(!re(e))return{kind:"invalid",error:"message_state acknowledgement was not an object"};if(n==="full"&&b(e.status)!=="ok")return{kind:"invalid",error:`...
L39: `," ")}function zk(e){if(!re(e))return;let n=F(e.payload)??{},t=F(e.actor),r=oe(e.seq),o=b(e.type);if(!(r===void 0||o===void 0))return{seq:r,type:o,actorKind:b(t?.kind),actorSlug:b...
L40: `)}function LRe(e)
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
Findings
4 Critical11 High7 Medium4 Low
CriticalSame File Env Network Executiondist/impl-ts/index.js
CriticalRemote Asset Decode Executedist/tcp-tunnel-cli.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/impl-ts/index.js
CriticalPrevious Version Dangerous Deltadist/impl-ts/index.js
HighChild Processscripts/vendor-codex-app-server-protocol.ts
HighShell
HighEvaldist/impl-ts/index.js
HighCredential Redirect Persistencedist/impl-ts/index.js
HighCommand Output Exfiltrationdist/impl-ts/index.js
HighSandbox Evasion Gated Capabilitydist/impl-ts/index.js
HighCross File Remote Execution Contextdist/impl-res/cloud-supervisor.mjs
Affected versions and remediation
This report applies to @linzumi/cli@1.0.261.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.261 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.