registry / @zaip-ai/cli / 1.3.8
@zaip-ai/cli@1.3.8
CLI oficial para instalar e configurar o ZAIP-AIOS em qualquer repositório
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not malicious npm install behavior, but the explicit setup command changes a global agent configuration and enables broad permissions. Treat it as a first-party agent extension lifecycle risk requiring a warning.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the zaip init command without --project-only.
Impact
Future Codex sessions can invoke project-controlled hook code and use a root-write, full-network default profile.
Mechanism
Global Codex hook installation and broad project permission configuration.
AI rationale
This is not malicious npm install behavior, but the explicit setup command changes a global agent configuration and enables broad permissions. Treat it as a first-party agent extension lifecycle risk requiring a warning.
Evidence
dist/services/install-agents-template.jsdist/services/global-codex-config.jsdist/services/codex-config-template.js~/.codex/config.toml.codex/config.toml.codex/hooks/zaip-pre-tool-use.mjs
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit init command installs a global Codex pre-tool hook by default.
- That hook is written to the user's Codex configuration directory and invokes a project-local script.
- The generated Codex configuration defines a root-write, full-network permission profile as the default.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The behavior is reached through the user-invoked zaip init command, not package installation.
- The inspected network download is limited to a pinned Node release with a SHA-256 check.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
8 flaggedtemplates/.agents/design/zaip-design.exeView file
•path = templates/.agents/design/zaip-design.exe
kind = payload_in_excluded_dir
sizeBytes = 7680
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.agents/design/zaip-design.exeView on unpkg•path = templates/.agents/design/zaip-design.exe
kind = native_binary
sizeBytes = 7680
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
templates/.agents/design/zaip-design.exeView on unpkgtemplates/.agents/design/packages/windows-launcher/build-design-launcher.ps1View file
•path = templates/.agents/design/packages/windows-launcher/build-design-launcher.ps1
kind = build_helper
sizeBytes = 3452
magicHex = [redacted]
Findings
1 Critical3 High7 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/services/doctor.js
HighPayload In Excluded Dirtemplates/.agents/design/zaip-design.exe
HighSemantic Analysis Limiteddist/services/codex-pre-tool-hook-template.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/services/stack-node.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarytemplates/.agents/design/zaip-design.exe
MediumShips Build Helpertemplates/.agents/design/packages/windows-launcher/build-design-launcher.ps1
MediumOversized Source Filetemplates/.agents/runtime/bin/zaip.mjs
MediumOversized Cli Entrypointtemplates/.agents/runtime/bin/zaip.mjs
Affected versions and remediation
This report applies to @zaip-ai/cli@1.3.8.
See all versions of @zaip-ai/cli for other recorded verdicts.
- Review the evidence and your use of @zaip-ai/cli@1.3.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.