@zaip-ai/cli@2.6.0
CLI oficial para instalar e configurar o ZAIP-AIOS em qualquer repositório
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not malicious install-hook abuse because it has no npm lifecycle trigger and requires an explicit CLI command. The command nevertheless creates a high-privilege AI-agent control surface and cloud-operation capability, so it warrants a warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs zaip init without --project-only.
Impact
A subsequently used Codex agent in the project can receive root-write and unrestricted-network defaults; the runner can use project cloud tokens for configured infrastructure operations.
Mechanism
Project and global AI-agent configuration mutation with privileged cloud-operation tooling.
AI rationale
This is not malicious install-hook abuse because it has no npm lifecycle trigger and requires an explicit CLI command. The command nevertheless creates a high-privilege AI-agent control surface and cloud-operation capability, so it warrants a warning.
Evidence
dist/services/adapters.jsdist/services/install-agents-template.jstemplates/.agents/tools/cloud-runner.mjs.codex/config.toml.codex/hooks/zaip-pre-tool-use.mjs.codex/hooks/zaip-conversation-lifecycle.mjs.codex/hooks/zaip-subagent-lifecycle.mjs~/.codex/config.toml.env.agents/.env
Network endpoints2
api.cloudflare.comdevelopers.hostinger.com
Decision evidence
public snapshotAI called this Suspicious at 95.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit init command installs a project-local Codex configuration and three command hooks.
- The generated Codex configuration defaults to root filesystem write access and unrestricted network access.
- Init also reconciles the user's global Codex configuration unless --project-only is selected.
- A bundled cloud runner reads project token files and can perform Cloudflare, Hostinger, Terraform, and SSH operations.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook and no self-dependency.
- The control-surface changes require the user to run the zaip init command.
- The cloud runner limits credential files to the project and validates a contract before its operations.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/services/stack-git.jsView file
1import { execFile } from "node:child_process";
L2: import { createHash } from "node:crypto";
...
L5: import { promisify } from "node:util";
L6: import { inflateRawSync } from "node:zlib";
L7: import { assertSafeDestination } from "./transactional-files.js";
L8: const exec = promisify(execFile);
L9: const API = "https://api.github.com/repos/git-for-windows/git/releases/latest";
L10: const KNOWN_DIGESTS = {
...
L12: };
L13: export function resolveGitForWindowsRelease(value, arch = process.arch) {
L14: const release = value;
...
L34: try {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/services/stack-git.jsView on unpkg · L1•matchType = previous_version_dangerous_delta
matchedPackage = @zaip-ai/cli@1.3.8
matchedIdentity = npm:QHphaXAtYWkvY2xp:1.3.8
similarity = 0.379
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/services/stack-git.jsView on unpkgFindings
1 Critical4 High7 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/services/doctor.js
HighSandbox Evasion Gated Capabilitydist/services/stack-git.js
HighPayload In Excluded Dirtemplates/.agents/design/zaip-design.exe
HighSemantic Analysis Limiteddist/services/codex-pre-tool-hook-template.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/services/stack-git.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarytemplates/.agents/design/zaip-design.exe
MediumShips Build Helpertemplates/.agents/design/packages/windows-launcher/build-design-launcher.ps1
MediumOversized Source Filetemplates/.agents/runtime/bin/zaip.mjs
Medium
Affected versions and remediation
This report applies to @zaip-ai/cli@2.6.0.
See all versions of @zaip-ai/cli for other recorded verdicts.
- Review the evidence and your use of @zaip-ai/cli@2.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.