@linzumi/cli@1.0.268
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains real remote provisioning and execution capability, so it warrants a warning. Static inspection did not establish malicious automatic execution, secret exfiltration, or persistence.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the linzumi CLI and selects its tunnel or cloud-agent workflow.
Impact
A user-provided or service-provided agent task can cause commands to run in a provisioned remote guest; this is a high-impact remote execution capability rather than an automatic install-time attack.
Mechanism
Authenticated tunnel access and remote guest provisioning with shell command execution.
AI rationale
The package contains real remote provisioning and execution capability, so it warrants a warning. Static inspection did not establish malicious automatic execution, secret exfiltration, or persistence.
Evidence
dist/tcp-tunnel-cli.mjsdist/impl-res/cloud-supervisor.mjsbin/linzumi.js
Network endpoints3
wss://linzumi.linkserve.linzumi.comapi.smolmachines.com
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The distributed TCP tunnel client connects to Linzumi WebSocket and API endpoints using local user authentication.
- The cloud supervisor provisions a guest with shell commands, installs Codex globally, and writes supervisor and MCP bundles before running agent work.
- The published CLI imports its bundled runtime when the user invokes the linzumi command.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The manifest has no dependency on its own package name.
- The observed network and command behavior is tied to explicit CLI and cloud-agent functionality; no automatic credential harvesting or install-time mutation was found.
- The scanner's dynamic-evaluation hit is present in bundled third-party validation code, not evidence of a fetched payload being executed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
18 flaggedscripts/vendor-codex-app-server-protocol.tsView file
13import { fileURLToPath } from 'node:url';
L14: import { spawn } from 'node:child_process';
L15:
High
Child Process
Package source references child process execution.
scripts/vendor-codex-app-server-protocol.tsView on unpkg · L13dist/impl-ts/index.jsView file
27${u}`.split(`
L28: `).filter(c=>c.trim()!=="")}catch{return[]}finally{n!==void 0&&CRe(n)}}function JRe(e){return e.filter(n=>n.type==="response_item").map(n=>O(n.payload)).filter(n=>n!==void 0).filte...
L29: `,"utf8");let r=new Map,o=0,i={runDir:t,contentMode:e.contentMode,record:(a,s,d={})=>{let u=uEe(r,t,a);o+=1,u.write(`${JSON.stringify({ts:new Date().toISOString(),mono_ms:pEe(),seq...
...
L40: `)}function Zs(e,n="inner"){if(!se(e))return{kind:"invalid",error:"message_state acknowledgement was not an object"};if(n==="full"&&b(e.status)!=="ok")return{kind:"invalid",error:`...
L41: `," ")}function yC(e){if(!se(e))return;let n=O(e.payload)??{},t=O(e.actor),r=ie(e.seq),o=b(e.type);if(!(r===void 0||o===void 0))return{seq:r,type:o,actorKind:b(t?.kind),actorSlug:b...
L42: `)}function EOe(
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
Findings
4 Critical11 High7 Medium4 Low
CriticalSame File Env Network Executiondist/impl-ts/index.js
CriticalRemote Asset Decode Executedist/tcp-tunnel-cli.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/impl-ts/index.js
CriticalPrevious Version Dangerous Deltadist/impl-res/cloud-supervisor.mjs
HighChild Processscripts/vendor-codex-app-server-protocol.ts
HighShell
HighEvaldist/impl-ts/index.js
HighCredential Redirect Persistencedist/impl-ts/index.js
HighCommand Output Exfiltrationdist/impl-ts/index.js
HighSandbox Evasion Gated Capabilitydist/impl-ts/index.js
HighCross File Remote Execution Contextdist/impl-res/cloud-supervisor.mjs
Affected versions and remediation
This report applies to @linzumi/cli@1.0.268.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.268 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.