registry / @linzumi/cli / 1.0.276
@linzumi/cli@1.0.276
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe guarded Claude-session write is a concrete agent extension lifecycle risk, warranting a warning. Static inspection found no automatic install execution, self-dependency chain, covert exfiltration, or destructive behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A runtime worker enables cross-harness failover when LINZUMI_CROSS_HARNESS_FAILOVER is set to true, 1, or on.
Impact
When deliberately enabled, this can add agent-session state to a user's Claude storage; no unconsented lifecycle trigger or confirmed credential export was found.
Mechanism
The feature creates a .claude/projects directory for the resolved working directory and writes a target session JSONL file.
AI rationale
The guarded Claude-session write is a concrete agent extension lifecycle risk, warranting a warning. Static inspection found no automatic install execution, self-dependency chain, covert exfiltration, or destructive behavior.
Evidence
dist/crossHarnessFailover.mjsdist/remote-codex-harness-worker.js.claude/projects/<resolved-working-directory>/<target-session-id>.jsonl
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Package metadata contains build and test scripts but no install lifecycle hook.
- The cross-harness routine creates a Claude project directory and writes a session JSONL transcript.
- Cross-harness failover is enabled only when the dedicated environment setting is true, 1, or on.
- The cloud supervisor uses an isolated Codex home and file-backed credential stores.
- The main bundle explicitly rejects forwarding ChatGPT OAuth credentials to the LLM proxy.
- The topics client validates a token against the configured service before use.
Evidence against
- A guarded failover capability can mutate Claude agent-session storage outside the package's own directory.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinified
Source & flagged code
18 flaggeddist/topics-cli.mjsView file
3var Cl=Object.create;var Qn=Object.defineProperty;var Fl=Object.getOwnPropertyDescriptor;var Il=Object.getOwnPropertyNames;var Nl=Object.getPrototypeOf,$l=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});H[le]||(fi=global[le]||[],mi(H,fi),H.close=(function(e){function t(r,n){return e.call(H,r,function(i){i||ci(),typeof n=="function"&&n.apply(this,argumen...
L5: `:return JSON.stringify(e);default:t=r+1|0;continue}}}function Ta(e){return e===""?[]:JSON.parse(e.split('"]["').join('","'))}function Aa(e){return"["+Lt(e)+"]"}function va(e){let ...
High
Child Process
Package source references child process execution.
dist/topics-cli.mjsView on unpkg · L37`),p=c.path,_=`
L8: - `+(p===""?"":"At "+p+": ")+f;d[_]||(d[_]=1,u=u+_)}}let s={code:"invalid_input",path:r,reason:u,expected:e,received:t,unionErrors:o};return i&&(s.input=n),s}function wn(e,t,r,n){r...
L9: `,h=n+".tmp."+process.pid.toString()+"."+Wi(6),_=y=>A(y.message);return P(U(Kt(qr.dirname(n)),_),()=>{let y=P(Ht(h,p,{encoding:"utf8",mode:384}),()=>zi(h,n));return y.TAG==="Ok"?{T...
High
2const require = __linzumiBundleCreateRequire(import.meta.url);
L3: var Cl=Object.create;var Qn=Object.defineProperty;var Fl=Object.getOwnPropertyDescriptor;var Il=Object.getOwnPropertyNames;var Nl=Object.getPrototypeOf,$l=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});H[le]||(fi=global[le]||[],mi(H,fi),H.close=(function(e){function t(r,n){return e.call(H,r,function(i){i||ci(),typeof n=="function"&&n.apply(this,argumen...
L5: `:return JSON.stringify(e);default:t=r+1|0;continue}}}function Ta(e){return e===""?[]:JSON.parse(e.split('"]["').join('","'))}function Aa(e){return"["+Lt(e)+"]"}function va(e){let ...
Findings
4 Critical11 High6 Medium5 Low
CriticalCredential Exfiltrationdist/cloud-supervisor.mjs
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/topics-cli.mjs
HighShell
HighEvaldist/topics-cli.mjs
HighSame File Env Network Executiondist/topics-cli.mjs
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/topics-cli.mjs
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/cloud-supervisor.mjs
Affected versions and remediation
This report applies to @linzumi/cli@1.0.276.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.276 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.