registry / @linzumi/cli / 1.0.328
@linzumi/cli@1.0.328
Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.
AI Security Review
scanned 10h ago · by lpm-firewall-aiThe manifest has no install hooks, and the launcher enters the CLI only when invoked. The reviewed credential routing and remote command request are tied to the configured proxy and hosted coding features; the scanner’s flagged attack behaviors were not established by the inspected source.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The user runs the `linzumi` command and selects a feature or provider.
Impact
These inspected behaviors support the package’s stated purpose; no unrelated collection or concealed execution was established.
Mechanism
The CLI routes credentials to the selected provider and sends feature requests, including hosted execution requests, to Linzumi services.
AI rationale
The manifest has no install hooks, and the launcher enters the CLI only when invoked. The reviewed credential routing and remote command request are tied to the configured proxy and hosted coding features; the scanner’s flagged attack behaviors were not established by the inspected source.
Network endpoints2
serve.linzumi.comlinzumi.link
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI entry point and defines no install lifecycle scripts.
- The launcher calls the CLI main function with user-supplied arguments.
- OpenAI credentials are routed to the configured Linzumi proxy only when the selected provider is `openai-proxy`.
- The hosted worker’s `/exec` request is part of the remote coding feature.
- The flagged remote asset loading code fetches a Ghostty WASM asset for the terminal component.
Evidence against
- The static scan flagged credential redirection, dynamic execution, and command-output exfiltration, but the inspected source excerpts do not establish a concealed or unrelated attack chain.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
27 flaggeddist/topics-cli.mjsView file
3var Cl=Object.create;var Qn=Object.defineProperty;var Fl=Object.getOwnPropertyDescriptor;var Nl=Object.getOwnPropertyNames;var Il=Object.getPrototypeOf,$l=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});V[le]||(fi=global[le]||[],mi(V,fi),V.close=(function(e){function t(r,n){return e.call(V,r,function(i){i||ci(),typeof n=="function"&&n.apply(this,argumen...
L5: `:return JSON.stringify(e);default:t=r+1|0;continue}}}function Tu(e){return e===""?[]:JSON.parse(e.split('"]["').join('","'))}function Au(e){return"["+Ut(e)+"]"}function vu(e){let ...
High
Child Process
Package source references child process execution.
dist/topics-cli.mjsView on unpkg · L37`),p=c.path,_=`
L8: - `+(p===""?"":"At "+p+": ")+d;f[_]||(f[_]=1,a=a+_)}}let s={code:"invalid_input",path:r,reason:a,expected:e,received:t,unionErrors:o};return i&&(s.input=n),s}function En(e,t,r,n){r...
L9: `,h=n+".tmp."+process.pid.toString()+"."+Wi(6),_=y=>A(y.message);return P(U(Kt(zr.dirname(n)),_),()=>{let y=P(Ht(h,p,{encoding:"utf8",mode:384}),()=>zi(h,n));return y.TAG==="Ok"?{T...
High
2const require = __linzumiBundleCreateRequire(import.meta.url);
L3: var Cl=Object.create;var Qn=Object.defineProperty;var Fl=Object.getOwnPropertyDescriptor;var Nl=Object.getOwnPropertyNames;var Il=Object.getPrototypeOf,$l=Object.prototype.hasOwnPr...
L4: GFS4: `),console.error(e)});V[le]||(fi=global[le]||[],mi(V,fi),V.close=(function(e){function t(r,n){return e.call(V,r,function(i){i||ci(),typeof n=="function"&&n.apply(this,argumen...
L5: `:return JSON.stringify(e);default:t=r+1|0;continue}}}function Tu(e){return e===""?[]:JSON.parse(e.split('"]["').join('","'))}function Au(e){return"["+Ut(e)+"]"}function vu(e){let ...
Findings
4 Critical19 High8 Medium4 Low
CriticalRemote Asset Decode Executedist/index.js
CriticalEncoded Package Runner Executiondist/hosted-coding-account-worker.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/mcp-server.mjs
HighChild Processdist/topics-cli.mjs
HighShell
HighEvaldist/topics-cli.mjs
HighSame File Env Network Executiondist/topics-cli.mjs
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/topics-cli.mjs
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Context
Affected versions and remediation
This report applies to @linzumi/cli@1.0.328.
See all versions of @linzumi/cli for other recorded verdicts.
- Review the evidence and your use of @linzumi/cli@1.0.328 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.