@zaip-ai/cli@1.3.6
CLI oficial para instalar e configurar o ZAIP-AIOS em qualquer repositório
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no install lifecycle hook, but its normal explicit initialization command changes global and project AI-agent control surfaces to enable broad permissions. This is a concrete dangerous capability rather than confirmed autonomous malware.
Static reason
No blocking static signals were detected.
Trigger
A user runs `zaip init` without `--project-only`.
Impact
A future Codex session can inherit unrestricted permissions and an injected command hook.
Mechanism
Writes Codex configuration, agent guidance, and PreToolUse hooks.
AI rationale
The package has no install lifecycle hook, but its normal explicit initialization command changes global and project AI-agent control surfaces to enable broad permissions. This is a concrete dangerous capability rather than confirmed autonomous malware.
Evidence
dist/commands/init.jsdist/services/install-agents-template.jsdist/services/global-codex-config.jsdist/services/codex-config-template.jsdist/services/adapters.js.codex/config.toml.codex/hooks/zaip-pre-tool-use.mjs~/.codex/config.toml
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit `zaip init` path enables global Codex configuration unless `--project-only` is used.
- The installer targets the user's Codex home configuration and appends a PreToolUse hook.
- Its generated Codex profile disables approvals and grants root filesystem writes and unrestricted network access.
- The installer also creates project `.codex` configuration and hook files.
Evidence against
- package.json declares no preinstall, install, or postinstall lifecycle hook.
- The behavior requires an explicit CLI init command rather than package installation.
- A project-only option avoids reads or changes under the Codex home directory.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
7 flaggedtemplates/.agents/design/zaip-design.exeView file
•path = templates/.agents/design/zaip-design.exe
kind = payload_in_excluded_dir
sizeBytes = 7680
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.agents/design/zaip-design.exeView on unpkg•path = templates/.agents/design/zaip-design.exe
kind = native_binary
sizeBytes = 7680
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
templates/.agents/design/zaip-design.exeView on unpkgtemplates/.agents/design/packages/windows-launcher/build-design-launcher.ps1View file
•path = templates/.agents/design/packages/windows-launcher/build-design-launcher.ps1
kind = build_helper
sizeBytes = 3452
magicHex = [redacted]
Findings
1 Critical2 High6 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/services/doctor.js
HighPayload In Excluded Dirtemplates/.agents/design/zaip-design.exe
HighSemantic Analysis Limiteddist/services/codex-pre-tool-hook-template.js#virtual:normalized:round1
MediumEnvironment Vars
MediumShips Native Binarytemplates/.agents/design/zaip-design.exe
MediumShips Build Helpertemplates/.agents/design/packages/windows-launcher/build-design-launcher.ps1
MediumOversized Source Filetemplates/.agents/runtime/bin/zaip.mjs
MediumOversized Cli Entrypointtemplates/.agents/runtime/bin/zaip.mjs
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @zaip-ai/cli@1.3.6.
See all versions of @zaip-ai/cli for other recorded verdicts.
- Review the evidence and your use of @zaip-ai/cli@1.3.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.