@linzumi/cli@1.0.271
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains substantial remote-agent and tunnelling capability, so it warrants a warning. The inspected source does not establish a malicious automatic execution chain.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the connect command or the cloud-supervised agent workflow.
Impact
A user who supplies credentials and starts these features grants the service access to relayed traffic and agent execution context.
Mechanism
Authenticated TCP tunnelling and supervised Codex process launch.
AI rationale
The package contains substantial remote-agent and tunnelling capability, so it warrants a warning. The inspected source does not establish a malicious automatic execution chain.
Evidence
dist/tcp-tunnel-cli.mjsdist/impl-res/cloud-supervisor.mjs
Network endpoints2
serve.linzumi.comlinzumi.link
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit connect command creates a remote TCP tunnel to the Linzumi service.
- The cloud supervisor can launch Codex with inherited environment values and a package-managed CODEX_HOME.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The tunnel is reached through an explicit CLI command, not during installation.
- No self-dependency on @linzumi/cli is declared.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
18 flaggedscripts/vendor-codex-app-server-protocol.tsView file
13import { fileURLToPath } from 'node:url';
L14: import { spawn } from 'node:child_process';
L15:
High
Child Process
Package source references child process execution.
scripts/vendor-codex-app-server-protocol.tsView on unpkg · L13dist/impl-ts/index.jsView file
27${u}`.split(`
L28: `).filter(c=>c.trim()!=="")}catch{return[]}finally{n!==void 0&&gEe(n)}}function $Ee(e){return e.filter(n=>n.type==="response_item").map(n=>q(n.payload)).filter(n=>n!==void 0).filte...
L29: `,"utf8");let r=new Map,o=0,i={runDir:t,contentMode:e.contentMode,record:(a,s,d={})=>{let u=eMe(r,t,a);o+=1,u.write(`${JSON.stringify({ts:new Date().toISOString(),mono_ms:oMe(),seq...
...
L40: `)}function td(e,n="inner"){if(!ie(e))return{kind:"invalid",error:"message_state acknowledgement was not an object"};if(n==="full"&&b(e.status)!=="ok")return{kind:"invalid",error:`...
L41: `," ")}function $C(e){if(!ie(e))return;let n=q(e.payload)??{},t=q(e.actor),r=te(e.seq),o=b(e.type);if(!(r===void 0||o===void 0))return{seq:r,type:o,actorKind:b(t?.kind),actorSlug:b...
L42: `)}function S1e(
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
Findings
4 Critical11 High7 Medium4 Low
CriticalSame File Env Network Executiondist/impl-ts/index.js
CriticalRemote Asset Decode Executedist/tcp-tunnel-cli.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/impl-ts/index.js
CriticalPrevious Version Dangerous Deltadist/impl-res/cloud-supervisor.mjs
HighChild Processscripts/vendor-codex-app-server-protocol.ts
HighShell
HighEvaldist/impl-ts/index.js
HighCredential Redirect Persistencedist/impl-ts/index.js
HighCommand Output Exfiltrationdist/impl-ts/index.js
HighSandbox Evasion Gated Capabilitydist/impl-ts/index.js
HighCross File Remote Execution Contextdist/impl-res/cloud-supervisor.mjs
Affected versions and remediation
This report applies to @linzumi/cli@1.0.271.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.271 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.