@linzumi/cli@1.0.272
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malicious install hook or exfiltration behavior was confirmed. Because the published bundle has broad agent and network capabilities plus opaque minified execution paths, it should be warned rather than marked clean.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the linzumi command and selects a runner, agent, or tunnel workflow.
Impact
A user who authorizes these workflows may expose local project access and network connectivity to the selected service.
Mechanism
User-invoked bundled agent runner and TCP tunnel functions.
AI rationale
No concrete malicious install hook or exfiltration behavior was confirmed. Because the published bundle has broad agent and network capabilities plus opaque minified execution paths, it should be warned rather than marked clean.
Evidence
bin/linzumi.jsdist/impl-ts/index.jsdist/tcp-tunnel-cli.mjsdist/impl-res/cloud-supervisor.mjs
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The published CLI contains large bundled runtime artifacts that combine local agent control, process access, file access, and network features, limiting reliable static attribution of all execution paths.
- The main bundle constructs a worker with dynamic evaluation enabled.
- The TCP and cloud supervisor artifacts are heavily bundled and include tunnel and remote-runner functionality.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The package exposes its behavior through an explicit linzumi command-line entrypoint rather than installation-time execution.
- No self-dependency, credential harvesting path, or concrete unsolicited exfiltration path was confirmed from the inspected source.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Source & flagged code
17 flaggedscripts/vendor-codex-app-server-protocol.tsView file
13import { fileURLToPath } from 'node:url';
L14: import { spawn } from 'node:child_process';
L15:
High
Child Process
Package source references child process execution.
scripts/vendor-codex-app-server-protocol.tsView on unpkg · L13dist/impl-ts/index.jsView file
27${u}`.split(`
L28: `).filter(c=>c.trim()!=="")}catch{return[]}finally{n!==void 0&&_Ee(n)}}function jEe(e){return e.filter(n=>n.type==="response_item").map(n=>q(n.payload)).filter(n=>n!==void 0).filte...
L29: `,"utf8");let r=new Map,o=0,i={runDir:t,contentMode:e.contentMode,record:(a,s,d={})=>{let u=tMe(r,t,a);o+=1,u.write(`${JSON.stringify({ts:new Date().toISOString(),mono_ms:aMe(),seq...
...
L40: `)}function od(e,n="inner"){if(!ie(e))return{kind:"invalid",error:"message_state acknowledgement was not an object"};if(n==="full"&&b(e.status)!=="ok")return{kind:"invalid",error:`...
L41: `," ")}function FC(e){if(!ie(e))return;let n=q(e.payload)??{},t=q(e.actor),r=te(e.seq),o=b(e.type);if(!(r===void 0||o===void 0))return{seq:r,type:o,actorKind:b(t?.kind),actorSlug:b...
L42: `)}function C1e(
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
Findings
3 Critical11 High7 Medium4 Low
CriticalSame File Env Network Executiondist/impl-ts/index.js
CriticalRemote Asset Decode Executedist/tcp-tunnel-cli.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/impl-ts/index.js
HighChild Processscripts/vendor-codex-app-server-protocol.ts
HighShell
HighEvaldist/impl-ts/index.js
HighCredential Redirect Persistencedist/impl-ts/index.js
HighCommand Output Exfiltrationdist/impl-ts/index.js
HighSandbox Evasion Gated Capabilitydist/impl-ts/index.js
HighCross File Remote Execution Contextdist/impl-res/cloud-supervisor.mjs
HighTrigger Reachable Command Output Exfiltrationdist/impl-ts/index.js
Affected versions and remediation
This report applies to @linzumi/cli@1.0.272.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.272 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.