@linzumi/cli@1.0.318
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThis is a credential handoff to the vendor during the account authorization flow, a material risk users should know about. Because the flow is request-triggered and requires provider login, the evidence supports a warning rather than a malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
An account authorization request starts the flow; the user completes the provider login.
Impact
The provider login credential is disclosed to the Linzumi service and can be used for hosted coding under that account.
Mechanism
The CLI launches Claude or Codex login in a temporary home, reads its credential files, then returns credential data in a `coding_account_authorized` event.
AI rationale
This is a credential handoff to the vendor during the account authorization flow, a material risk users should know about. Because the flow is request-triggered and requires provider login, the evidence supports a warning rather than a malicious verdict.
Evidence
dist/index.js/tmp/linzumi-claude-account-*/.credentials.json/tmp/linzumi-claude-account-*/.claude.json/tmp/linzumi-coding-account-*/auth.json
Network endpoints1
serve.linzumi.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The account authorization handler launches Claude or Codex provider login flows in temporary directories.
- After login, the CLI reads provider credential files and serializes credential data with account details.
- It sends the credential in a `coding_account_authorized` event to the service callback.
- The flow publishes a verification URL and waits for user authorization.
Evidence against
- The manifest has no install, preinstall, or postinstall hook; the executable calls the CLI when a user runs `linzumi`.
- The credential flow is reached through an account authorization request and requires completing the provider login flow, rather than running on package installation or import.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
32 flaggeddist/topics-cli.mjsView file
3var Cl=Object.create;var Qn=Object.defineProperty;var Fl=Object.getOwnPropertyDescriptor;var Nl=Object.getOwnPropertyNames;var Il=Object.getPrototypeOf,$l=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});V[le]||(fi=global[le]||[],mi(V,fi),V.close=(function(e){function t(r,n){return e.call(V,r,function(i){i||ci(),typeof n=="function"&&n.apply(this,argumen...
L5: `:return JSON.stringify(e);default:t=r+1|0;continue}}}function Tu(e){return e===""?[]:JSON.parse(e.split('"]["').join('","'))}function Au(e){return"["+Ut(e)+"]"}function vu(e){let ...
High
Child Process
Package source references child process execution.
dist/topics-cli.mjsView on unpkg · L37`),p=c.path,_=`
L8: - `+(p===""?"":"At "+p+": ")+d;f[_]||(f[_]=1,a=a+_)}}let s={code:"invalid_input",path:r,reason:a,expected:e,received:t,unionErrors:o};return i&&(s.input=n),s}function En(e,t,r,n){r...
L9: `,h=n+".tmp."+process.pid.toString()+"."+Wi(6),_=y=>A(y.message);return P(U(Kt(zr.dirname(n)),_),()=>{let y=P(Ht(h,p,{encoding:"utf8",mode:384}),()=>zi(h,n));return y.TAG==="Ok"?{T...
High
2const require = __linzumiBundleCreateRequire(import.meta.url);
L3: var Cl=Object.create;var Qn=Object.defineProperty;var Fl=Object.getOwnPropertyDescriptor;var Nl=Object.getOwnPropertyNames;var Il=Object.getPrototypeOf,$l=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});V[le]||(fi=global[le]||[],mi(V,fi),V.close=(function(e){function t(r,n){return e.call(V,r,function(i){i||ci(),typeof n=="function"&&n.apply(this,argumen...
L5: `:return JSON.stringify(e);default:t=r+1|0;continue}}}function Tu(e){return e===""?[]:JSON.parse(e.split('"]["').join('","'))}function Au(e){return"["+Ut(e)+"]"}function vu(e){let ...
Findings
3 Critical24 High8 Medium5 Low
CriticalCredential Exfiltrationdist/cloud-supervisor.mjs
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/topics-cli.mjs
HighShell
HighEvaldist/topics-cli.mjs
HighSame File Env Network Executiondist/topics-cli.mjs
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/topics-cli.mjs
HighCloud Metadata Accessdist/cloud-supervisor.mjs
HighRemote Agent Bridgedist/cloud-supervisor.mjs
HighCross File Remote Execution Contextdist/cloud-supervisor.mjs
Affected versions and remediation
This report applies to @linzumi/cli@1.0.318.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.318 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.