@linzumi/cli@1.0.290
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 29d ago · by lpm-firewall-aiSource inspection confirms conditional forwarding of an existing Linzumi token into MCP configuration for a caller-selected API URL, without an inspected destination restriction. The explicit opt-in makes this a warning-level credential exposure capability rather than evidence of covert theft.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the MCP config command with `--include-token` and supplies an API URL.
Impact
The configured endpoint may receive the Linzumi token when the user later starts that MCP server.
Mechanism
The command obtains the initial access token and supplies it to configuration generation, which places it in the MCP server environment.
AI rationale
Source inspection confirms conditional forwarding of an existing Linzumi token into MCP configuration for a caller-selected API URL, without an inspected destination restriction. The explicit opt-in makes this a warning-level credential exposure capability rather than evidence of covert theft.
Evidence
dist/index.js
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit MCP config command reads the initial service token only when `--include-token` is set, then passes that token and the supplied API URL into config generation.
- Generated MCP configuration puts the token in `LINZUMI_MCP_ACCESS_TOKEN` alongside the server command arguments; the API URL is caller-supplied and is not restricted in the inspected path.
Evidence against
- Token inclusion is gated by an explicit command-line flag; the inspected flow does not show automatic install-time agent configuration changes.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
18 flaggeddist/topics-cli.mjsView file
3var Cl=Object.create;var Qn=Object.defineProperty;var Fl=Object.getOwnPropertyDescriptor;var Nl=Object.getOwnPropertyNames;var Il=Object.getPrototypeOf,$l=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});V[le]||(fi=global[le]||[],mi(V,fi),V.close=(function(e){function t(r,n){return e.call(V,r,function(i){i||ci(),typeof n=="function"&&n.apply(this,argumen...
L5: `:return JSON.stringify(e);default:t=r+1|0;continue}}}function Tu(e){return e===""?[]:JSON.parse(e.split('"]["').join('","'))}function Au(e){return"["+Ut(e)+"]"}function vu(e){let ...
High
Child Process
Package source references child process execution.
dist/topics-cli.mjsView on unpkg · L37`),p=c.path,_=`
L8: - `+(p===""?"":"At "+p+": ")+d;f[_]||(f[_]=1,a=a+_)}}let s={code:"invalid_input",path:r,reason:a,expected:e,received:t,unionErrors:o};return i&&(s.input=n),s}function En(e,t,r,n){r...
L9: `,h=n+".tmp."+process.pid.toString()+"."+Wi(6),_=y=>A(y.message);return P(U(Kt(zr.dirname(n)),_),()=>{let y=P(Ht(h,p,{encoding:"utf8",mode:384}),()=>zi(h,n));return y.TAG==="Ok"?{T...
High
2const require = __linzumiBundleCreateRequire(import.meta.url);
L3: var Cl=Object.create;var Qn=Object.defineProperty;var Fl=Object.getOwnPropertyDescriptor;var Nl=Object.getOwnPropertyNames;var Il=Object.getPrototypeOf,$l=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});V[le]||(fi=global[le]||[],mi(V,fi),V.close=(function(e){function t(r,n){return e.call(V,r,function(i){i||ci(),typeof n=="function"&&n.apply(this,argumen...
L5: `:return JSON.stringify(e);default:t=r+1|0;continue}}}function Tu(e){return e===""?[]:JSON.parse(e.split('"]["').join('","'))}function Au(e){return"["+Ut(e)+"]"}function vu(e){let ...
Findings
3 Critical12 High6 Medium5 Low
CriticalCredential Exfiltrationdist/cloud-supervisor.mjs
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/topics-cli.mjs
HighShell
HighEvaldist/topics-cli.mjs
HighSame File Env Network Executiondist/topics-cli.mjs
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/topics-cli.mjs
HighCloud Metadata Accessdist/cloud-supervisor.mjs
HighRemote Agent Bridgedist/cloud-supervisor.mjs
HighCross File Remote Execution Contextdist/cloud-supervisor.mjs
Affected versions and remediation
This report applies to @linzumi/cli@1.0.290.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.290 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.