registry / @linzumi/cli / 1.0.284
@linzumi/cli@1.0.284
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource inspection supports package-aligned CLI and session-management behavior at every indicated agent location. The claimed remote asset execution chain was not substantiated, and the sensitive hosted callback receives credentials from a fresh authorization flow.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Explicit CLI operation, hosted authorization, session recovery, or a user-requested harness switch activates the inspected behavior.
Impact
No covert existing-session export, install-time control mutation, or remote payload execution was established.
Mechanism
The code validates authentication state and restores conversation files; hosted login uses an isolated temporary home. Inspected dynamic evaluation generates schema functions rather than executing downloaded assets.
AI rationale
Source inspection supports package-aligned CLI and session-management behavior at every indicated agent location. The claimed remote asset execution chain was not substantiated, and the sensitive hosted callback receives credentials from a fresh authorization flow.
Decision evidence
public snapshotAI called this Clean at 82.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares a CLI entrypoint, with no install lifecycle hooks or runtime self-dependency; the launcher passes user arguments to main.
- The cloud agent location searches executable directories, including the legacy Claude executable directory.
- The cross-harness and remote worker locations select project conversation stores; callers restore transcript messages for session recovery or a user-requested harness switch.
- The index agent location resolves the Codex authentication directory; surrounding code validates authentication state.
- The topics bundle generates transformation functions from its internal schema representation.
- Hosted authorization runs device login in a fresh temporary home and sends the resulting credentials through its configured authorization callback.
Evidence against
- Hosted authorization handles sensitive credentials, and the package includes native helpers whose complete behavior was not established by these source excerpts.
Behavioral surface
ChildProcessCrypto
Source & flagged code
19 flaggeddist/topics-cli.mjsView file
3var Cl=Object.create;var Qn=Object.defineProperty;var Fl=Object.getOwnPropertyDescriptor;var Nl=Object.getOwnPropertyNames;var Il=Object.getPrototypeOf,$l=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});V[le]||(fi=global[le]||[],mi(V,fi),V.close=(function(e){function t(r,n){return e.call(V,r,function(i){i||ci(),typeof n=="function"&&n.apply(this,argumen...
L5: `:return JSON.stringify(e);default:t=r+1|0;continue}}}function Tu(e){return e===""?[]:JSON.parse(e.split('"]["').join('","'))}function Au(e){return"["+Ut(e)+"]"}function vu(e){let ...
High
Child Process
Package source references child process execution.
dist/topics-cli.mjsView on unpkg · L37`),p=c.path,_=`
L8: - `+(p===""?"":"At "+p+": ")+d;f[_]||(f[_]=1,a=a+_)}}let s={code:"invalid_input",path:r,reason:a,expected:e,received:t,unionErrors:o};return i&&(s.input=n),s}function En(e,t,r,n){r...
L9: `,h=n+".tmp."+process.pid.toString()+"."+Wi(6),_=y=>A(y.message);return P(U(Kt(zr.dirname(n)),_),()=>{let y=P(Ht(h,p,{encoding:"utf8",mode:384}),()=>zi(h,n));return y.TAG==="Ok"?{T...
High
2const require = __linzumiBundleCreateRequire(import.meta.url);
L3: var Cl=Object.create;var Qn=Object.defineProperty;var Fl=Object.getOwnPropertyDescriptor;var Nl=Object.getOwnPropertyNames;var Il=Object.getPrototypeOf,$l=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});V[le]||(fi=global[le]||[],mi(V,fi),V.close=(function(e){function t(r,n){return e.call(V,r,function(i){i||ci(),typeof n=="function"&&n.apply(this,argumen...
L5: `:return JSON.stringify(e);default:t=r+1|0;continue}}}function Tu(e){return e===""?[]:JSON.parse(e.split('"]["').join('","'))}function Au(e){return"["+Ut(e)+"]"}function vu(e){let ...
Findings
4 Critical12 High6 Medium5 Low
CriticalCredential Exfiltrationdist/cloud-supervisor.mjs
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/cloud-supervisor.mjs
HighChild Processdist/topics-cli.mjs
HighShell
HighEvaldist/topics-cli.mjs
HighSame File Env Network Executiondist/topics-cli.mjs
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/topics-cli.mjs
HighCloud Metadata Accessdist/cloud-supervisor.mjs
HighRemote Agent Bridgedist/cloud-supervisor.mjs
Affected versions and remediation
This report applies to @linzumi/cli@1.0.284.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.284 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.