@zaip-ai/cli@1.3.4
CLI oficial para instalar e configurar o ZAIP-AIOS em qualquer repositório
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an explicit-user-command AI-agent configuration mutator with unusually broad defaults, not an install-time malware chain. Its capabilities warrant a warning, but the reviewed source does not establish malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
A user runs zaip init or zaip adapters build.
Impact
A subsequently used Codex agent can receive root filesystem write access, full network access, inherited environment variables, and enabled computer-use tooling.
Mechanism
Writes agent configuration, hooks, and broad capability settings.
AI rationale
This is an explicit-user-command AI-agent configuration mutator with unusually broad defaults, not an install-time malware chain. Its capabilities warrant a warning, but the reviewed source does not establish malicious behavior.
Evidence
dist/commands/init.jsdist/services/adapters.jsdist/services/global-codex-config.js.codex/config.toml.codex/hooks/zaip-pre-tool-use.mjs.codex/hooks/zaip-subagent-lifecycle.mjsCODEX_HOME/config.toml
Network endpoints1
developers.openai.com/mcp
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit init command installs a project template and normally enables global Codex configuration changes.
- Generated project Codex configuration sets a full-access profile as the default.
- That profile grants root filesystem writes, unrestricted networking, inherited environment variables, and enabled browser/computer-use plugins.
- The installer writes Codex configuration and hook files into the target project.
- The global configuration reconciler adds a PreToolUse hook to the user's Codex config.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- All configuration mutation is reached through explicit CLI commands, not package installation.
- The reviewed hook source is a command safety filter; no credential exfiltration or remote payload download was found.
- The shipped Windows executable is accompanied by source that launches a local design runtime; the design server binds to loopback only.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
10 flaggedtemplates/.agents/design/zaip-design.exeView file
•path = templates/.agents/design/zaip-design.exe
kind = payload_in_excluded_dir
sizeBytes = 7680
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.agents/design/zaip-design.exeView on unpkg•path = templates/.agents/design/zaip-design.exe
kind = native_binary
sizeBytes = 7680
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
templates/.agents/design/zaip-design.exeView on unpkgtemplates/.agents/design/packages/windows-launcher/build-design-launcher.ps1View file
•path = templates/.agents/design/packages/windows-launcher/build-design-launcher.ps1
kind = build_helper
sizeBytes = 3452
magicHex = [redacted]
Findings
1 Critical3 High7 Medium6 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/services/doctor.js
HighShips High Entropy Blobtemplates/.agents/branding/brandbook.docx
HighPayload In Excluded Dirtemplates/.agents/design/zaip-design.exe
HighSemantic Analysis Limiteddist/services/codex-pre-tool-hook-template.js#virtual:normalized:round1
MediumEnvironment Vars
MediumShips Native Binarytemplates/.agents/design/zaip-design.exe
MediumShips Build Helpertemplates/.agents/design/packages/windows-launcher/build-design-launcher.ps1
MediumShips Compressed Blobtemplates/.agents/branding/brandbook.docx
MediumOversized Source Filetemplates/.agents/runtime/bin/zaip.mjs
MediumOversized Cli Entrypointtemplates/.agents/runtime/bin/zaip.mjs
Affected versions and remediation
This report applies to @zaip-ai/cli@1.3.4.
See all versions of @zaip-ai/cli for other recorded verdicts.
- Review the evidence and your use of @zaip-ai/cli@1.3.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.