@linzumi/cli@1.0.311
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe CLI routes Anthropic API-key authentication through Linzumi’s proxy in applicable agent contexts, sending a third-party provider credential to the package vendor without clear disclosure or consent. This meets the credential-exfiltration rule despite the otherwise legitimate CLI purpose.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Run the CLI and start an agent using an Anthropic API key in a context with a Linzumi proxy binding.
Impact
The vendor proxy receives the user’s Anthropic credential, exposing it to use outside the user’s direct Anthropic connection.
Mechanism
The routing logic identifies API-key authentication and selects LlmProxy; the configured provider sends model requests through the Linzumi proxy endpoint.
Attack narrative
When an agent uses Anthropic API-key authentication and a Linzumi proxy binding is present, the CLI selects the LlmProxy lane. It configures that provider as “Linzumi Proxy” and directs model requests to the configured proxy base URL. This sends the user’s provider credential through the vendor’s service without clear disclosure in the package documentation.
AI rationale
The CLI routes Anthropic API-key authentication through Linzumi’s proxy in applicable agent contexts, sending a third-party provider credential to the package vendor without clear disclosure or consent. This meets the credential-exfiltration rule despite the otherwise legitimate CLI purpose.
Evidence
dist/index.jsbin/linzumi.js
Network endpoints2
serve.linzumi.comconfigured llmProxyBaseUrl
Decision evidence
public snapshotAI called this Malicious at 90.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CLI detects ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN and routes user API key credentials through the LlmProxy lane when a proxy binding applies.
- The proxy provider is named “Linzumi Proxy” and sends model requests to the configured proxy base URL at /v1.
- The executable entry point calls main() with the user’s CLI arguments; the README describes signing in and connecting to a Linzumi workspace.
- The package sets https://serve.linzumi.com as its default service endpoint.
Evidence against
- The package has no install, preinstall, or postinstall hook.
- The package is a documented local coding-agent CLI, so model-provider requests are part of its stated purpose.
- The credential routing occurs in the model-provider path rather than as an install-time action.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Source & flagged code
20 flaggeddist/topics-cli.mjsView file
3var Cl=Object.create;var Qn=Object.defineProperty;var Fl=Object.getOwnPropertyDescriptor;var Nl=Object.getOwnPropertyNames;var Il=Object.getPrototypeOf,$l=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});V[le]||(fi=global[le]||[],mi(V,fi),V.close=(function(e){function t(r,n){return e.call(V,r,function(i){i||ci(),typeof n=="function"&&n.apply(this,argumen...
L5: `:return JSON.stringify(e);default:t=r+1|0;continue}}}function Tu(e){return e===""?[]:JSON.parse(e.split('"]["').join('","'))}function Au(e){return"["+Ut(e)+"]"}function vu(e){let ...
High
Child Process
Package source references child process execution.
dist/topics-cli.mjsView on unpkg · L37`),p=c.path,_=`
L8: - `+(p===""?"":"At "+p+": ")+d;f[_]||(f[_]=1,a=a+_)}}let s={code:"invalid_input",path:r,reason:a,expected:e,received:t,unionErrors:o};return i&&(s.input=n),s}function En(e,t,r,n){r...
L9: `,h=n+".tmp."+process.pid.toString()+"."+Wi(6),_=y=>A(y.message);return P(U(Kt(zr.dirname(n)),_),()=>{let y=P(Ht(h,p,{encoding:"utf8",mode:384}),()=>zi(h,n));return y.TAG==="Ok"?{T...
High
2const require = __linzumiBundleCreateRequire(import.meta.url);
L3: var Cl=Object.create;var Qn=Object.defineProperty;var Fl=Object.getOwnPropertyDescriptor;var Nl=Object.getOwnPropertyNames;var Il=Object.getPrototypeOf,$l=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});V[le]||(fi=global[le]||[],mi(V,fi),V.close=(function(e){function t(r,n){return e.call(V,r,function(i){i||ci(),typeof n=="function"&&n.apply(this,argumen...
L5: `:return JSON.stringify(e);default:t=r+1|0;continue}}}function Tu(e){return e===""?[]:JSON.parse(e.split('"]["').join('","'))}function Au(e){return"["+Ut(e)+"]"}function vu(e){let ...
Findings
3 Critical12 High8 Medium5 Low
CriticalCredential Exfiltrationdist/cloud-supervisor.mjs
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/topics-cli.mjs
HighShell
HighEvaldist/topics-cli.mjs
HighSame File Env Network Executiondist/topics-cli.mjs
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/topics-cli.mjs
HighCloud Metadata Accessdist/cloud-supervisor.mjs
HighRemote Agent Bridgedist/cloud-supervisor.mjs
HighCross File Remote Execution Contextdist/cloud-supervisor.mjs
Affected versions and remediation
This report applies to @linzumi/cli@1.0.311.
See all versions of @linzumi/cli for other recorded verdicts.
- Avoid installing @linzumi/cli@1.0.311. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.