registry / @linzumi/cli / 1.0.298
@linzumi/cli@1.0.298
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 16d ago · by lpm-firewall-aiStatic hints identify bundled dynamic code and credential-related operations, but inspected excerpts show CLI and integration behavior without a concrete attack chain. No lifecycle hook is declared, and the inspected authentication paths use local token parsing and Linzumi’s service host.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user invokes the linzumi command or its topics/failover features.
Impact
No unauthorized credential transfer, install-time mutation, or other attack effect was established.
Mechanism
The inspected paths resolve executables, parse local Codex OAuth data, use Linzumi’s local auth cache, and create a Claude project transcript path for failover.
AI rationale
Static hints identify bundled dynamic code and credential-related operations, but inspected excerpts show CLI and integration behavior without a concrete attack chain. No lifecycle hook is declared, and the inspected authentication paths use local token parsing and Linzumi’s service host.
Evidence
~/.linzumi/auth.json~/.claude/projects
Network endpoints1
serve.linzumi.com
Decision evidence
public snapshotAI called this Clean at 74.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json exposes a user-invoked CLI and declares no install lifecycle hook.
- cloud-supervisor.mjs includes executable lookup logic; the inspected target contains no agent configuration mutation.
- crossHarnessFailover.mjs creates a Claude project path for session failover; the inspected code is a transcript compatibility path.
- index.js and remote-codex-harness-worker.js parse Codex OAuth tokens from the local .codex auth flow.
- mcp-server.mjs uses Linzumi’s service host and reads its local Linzumi auth cache.
- topics-cli.mjs requires workspace and topic arguments for the inspected command path.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
21 flaggeddist/topics-cli.mjsView file
3var Cl=Object.create;var Qn=Object.defineProperty;var Fl=Object.getOwnPropertyDescriptor;var Nl=Object.getOwnPropertyNames;var Il=Object.getPrototypeOf,$l=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});V[le]||(fi=global[le]||[],mi(V,fi),V.close=(function(e){function t(r,n){return e.call(V,r,function(i){i||ci(),typeof n=="function"&&n.apply(this,argumen...
L5: `:return JSON.stringify(e);default:t=r+1|0;continue}}}function Tu(e){return e===""?[]:JSON.parse(e.split('"]["').join('","'))}function Au(e){return"["+Ut(e)+"]"}function vu(e){let ...
High
Child Process
Package source references child process execution.
dist/topics-cli.mjsView on unpkg · L37`),p=c.path,_=`
L8: - `+(p===""?"":"At "+p+": ")+d;f[_]||(f[_]=1,a=a+_)}}let s={code:"invalid_input",path:r,reason:a,expected:e,received:t,unionErrors:o};return i&&(s.input=n),s}function En(e,t,r,n){r...
L9: `,h=n+".tmp."+process.pid.toString()+"."+Wi(6),_=y=>A(y.message);return P(U(Kt(zr.dirname(n)),_),()=>{let y=P(Ht(h,p,{encoding:"utf8",mode:384}),()=>zi(h,n));return y.TAG==="Ok"?{T...
High
2const require = __linzumiBundleCreateRequire(import.meta.url);
L3: var Cl=Object.create;var Qn=Object.defineProperty;var Fl=Object.getOwnPropertyDescriptor;var Nl=Object.getOwnPropertyNames;var Il=Object.getPrototypeOf,$l=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});V[le]||(fi=global[le]||[],mi(V,fi),V.close=(function(e){function t(r,n){return e.call(V,r,function(i){i||ci(),typeof n=="function"&&n.apply(this,argumen...
L5: `:return JSON.stringify(e);default:t=r+1|0;continue}}}function Tu(e){return e===""?[]:JSON.parse(e.split('"]["').join('","'))}function Au(e){return"["+Ut(e)+"]"}function vu(e){let ...
Findings
4 Critical12 High8 Medium5 Low
CriticalCredential Exfiltrationdist/cloud-supervisor.mjs
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/mcp-server.mjs
HighChild Processdist/topics-cli.mjs
HighShell
HighEvaldist/topics-cli.mjs
HighSame File Env Network Executiondist/topics-cli.mjs
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/topics-cli.mjs
HighCloud Metadata Accessdist/cloud-supervisor.mjs
HighRemote Agent Bridgedist/cloud-supervisor.mjs
Affected versions and remediation
This report applies to @linzumi/cli@1.0.298.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.298 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.