registry / @linzumi/cli / 1.0.305
@linzumi/cli@1.0.305
⚠ Under reviewLinzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe two shipped executable artifacts have unsupported formats in the available offline analysis, leaving their behavior unresolved. The hosted-account flow also returns credential data to an environment-supplied callback URL, whose owner and authorization context are not established by the inspected source; manual review is warranted.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
When a platform helper is invoked, or when the hosted-account authorization flow completes.
Impact
The binaries' effects and the callback recipient's ownership remain unverified, so package behavior cannot be fully assessed.
Mechanism
The helper binaries could not be analyzed; the authorization flow sends credential data to an environment-supplied callback URL.
AI rationale
The two shipped executable artifacts have unsupported formats in the available offline analysis, leaving their behavior unresolved. The hosted-account flow also returns credential data to an environment-supplied callback URL, whose owner and authorization context are not established by the inspected source; manual review is warranted.
Evidence
native/darwin/linzumi-terminal-pty-helperdist/native/darwin/preview-process-identity.lpm-inspection-oQgU6S/0-4ed8952bc81b.txt.lpm-inspection-oQgU6S/1-032552cc5b1e.txtdist/cloud-supervisor.mjs
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The shipped macOS terminal helper is an executable whose offline analysis could not identify its format or behavior.
- The shipped process identity executable is also unresolved by offline analysis.
- A hosted-account flow sends credential data to a callback URL supplied through the environment; the inspected source does not establish who controls that destination.
Evidence against
- The CLI entrypoint loads the main application when invoked; this does not establish malicious behavior.
- The hosted-account callback is part of a specific hosted authorization flow and uses a callback token.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
20 flaggeddist/topics-cli.mjsView file
3var Cl=Object.create;var Qn=Object.defineProperty;var Fl=Object.getOwnPropertyDescriptor;var Nl=Object.getOwnPropertyNames;var $l=Object.getPrototypeOf,Il=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});V[le]||(fi=global[le]||[],mi(V,fi),V.close=(function(e){function t(r,n){return e.call(V,r,function(i){i||ci(),typeof n=="function"&&n.apply(this,argumen...
L5: `:return JSON.stringify(e);default:t=r+1|0;continue}}}function Tu(e){return e===""?[]:JSON.parse(e.split('"]["').join('","'))}function Au(e){return"["+Ut(e)+"]"}function vu(e){let ...
High
Child Process
Package source references child process execution.
dist/topics-cli.mjsView on unpkg · L37`),p=c.path,_=`
L8: - `+(p===""?"":"At "+p+": ")+d;f[_]||(f[_]=1,a=a+_)}}let s={code:"invalid_input",path:r,reason:a,expected:e,received:t,unionErrors:o};return i&&(s.input=n),s}function En(e,t,r,n){r...
L9: `,h=n+".tmp."+process.pid.toString()+"."+Wi(6),_=y=>A(y.message);return P(U(Kt(zr.dirname(n)),_),()=>{let y=P(Ht(h,p,{encoding:"utf8",mode:384}),()=>zi(h,n));return y.TAG==="Ok"?{T...
High
2const require = __linzumiBundleCreateRequire(import.meta.url);
L3: var Cl=Object.create;var Qn=Object.defineProperty;var Fl=Object.getOwnPropertyDescriptor;var Nl=Object.getOwnPropertyNames;var $l=Object.getPrototypeOf,Il=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});V[le]||(fi=global[le]||[],mi(V,fi),V.close=(function(e){function t(r,n){return e.call(V,r,function(i){i||ci(),typeof n=="function"&&n.apply(this,argumen...
L5: `:return JSON.stringify(e);default:t=r+1|0;continue}}}function Tu(e){return e===""?[]:JSON.parse(e.split('"]["').join('","'))}function Au(e){return"["+Ut(e)+"]"}function vu(e){let ...
Findings
3 Critical12 High8 Medium5 Low
CriticalCredential Exfiltrationdist/cloud-supervisor.mjs
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/topics-cli.mjs
HighShell
HighEvaldist/topics-cli.mjs
HighSame File Env Network Executiondist/topics-cli.mjs
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/topics-cli.mjs
HighCloud Metadata Accessdist/cloud-supervisor.mjs
HighRemote Agent Bridgedist/cloud-supervisor.mjs
HighCross File Remote Execution Contextdist/cloud-supervisor.mjs
Affected versions and remediation
This report applies to @linzumi/cli@1.0.305.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.305 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.