@zaip-ai/cli@1.3.7
CLI oficial para instalar e configurar o ZAIP-AIOS em qualquer repositório
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not malicious install-hook abuse because it has no automatic npm lifecycle trigger. It is a dangerous, user-invoked agent configuration capability that warrants a warning.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs zaip init without --project-only.
Impact
A configured Codex session can receive root filesystem and unrestricted network permissions and run project hook scripts.
Mechanism
Writes Codex configuration and hook scripts with broad permissions.
AI rationale
This is not malicious install-hook abuse because it has no automatic npm lifecycle trigger. It is a dangerous, user-invoked agent configuration capability that warrants a warning.
Evidence
dist/services/codex-config-template.jsdist/services/install-agents-template.jsdist/services/adapters.js.codex/config.toml.codex/hooks/zaip-pre-tool-use.mjs.codex/hooks/zaip-subagent-lifecycle.mjs~/.codex/config.toml
Network endpoints1
developers.openai.com/mcp
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit init command installs a project Codex configuration that grants root write access, unrestricted network access, and all environment inheritance.
- The installer writes project .codex configuration and hook files, and by default also reconciles the user's global Codex configuration.
- The installed configuration registers command hooks that run project-controlled Node scripts for tool and subagent events.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The write and configuration behavior is reached through the user-invoked init command.
- The shipped Windows launcher source starts a local bundled Node script; no secret collection or exfiltration was confirmed.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedtemplates/.agents/design/zaip-design.exeView file
•path = templates/.agents/design/zaip-design.exe
kind = payload_in_excluded_dir
sizeBytes = 7680
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.agents/design/zaip-design.exeView on unpkg•path = templates/.agents/design/zaip-design.exe
kind = native_binary
sizeBytes = 7680
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
templates/.agents/design/zaip-design.exeView on unpkgtemplates/.agents/design/packages/windows-launcher/build-design-launcher.ps1View file
•path = templates/.agents/design/packages/windows-launcher/build-design-launcher.ps1
kind = build_helper
sizeBytes = 3452
magicHex = [redacted]
Findings
1 Critical3 High6 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/services/doctor.js
HighPayload In Excluded Dirtemplates/.agents/design/zaip-design.exe
HighSemantic Analysis Limiteddist/services/codex-pre-tool-hook-template.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/services/sqlite-bootstrap.js
MediumEnvironment Vars
MediumShips Native Binarytemplates/.agents/design/zaip-design.exe
MediumShips Build Helpertemplates/.agents/design/packages/windows-launcher/build-design-launcher.ps1
MediumOversized Source Filetemplates/.agents/runtime/bin/zaip.mjs
MediumOversized Cli Entrypointtemplates/.agents/runtime/bin/zaip.mjs
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @zaip-ai/cli@1.3.7.
See all versions of @zaip-ai/cli for other recorded verdicts.
- Review the evidence and your use of @zaip-ai/cli@1.3.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.