registry / @zaip-ai/cli / 3.0.0
@zaip-ai/cli@3.0.0
CLI oficial para instalar e configurar o ZAIP-AIOS em qualquer repositório
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is not malicious by static inspection because it has no install lifecycle hook or confirmed covert exfiltration. It warrants a warning because its normal init command modifies global Codex hook configuration and installs agent tooling with privileged cloud operations.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs the zaip init command without --project-only.
Impact
The installed hook can affect subsequent Codex tool use; cloud operations can alter approved DNS or remote hosts when separately invoked with credentials.
Mechanism
Global Codex hook installation and contract-gated cloud administration.
AI rationale
The package is not malicious by static inspection because it has no install lifecycle hook or confirmed covert exfiltration. It warrants a warning because its normal init command modifies global Codex hook configuration and installs agent tooling with privileged cloud operations.
Evidence
dist/commands/init.jsdist/services/global-codex-config.jstemplates/.agents/tools/cloud-runner.mjs.agents/config/agents/catalog.yaml$CODEX_HOME/config.toml.agents/tools/cloud-runner.mjs
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit init command enables global Codex configuration by default unless the user selects --project-only.
- The installer rewrites the Codex configuration file and installs a ZAIP pre-tool hook.
- The shipped cloud runner can use supplied cloud credentials for contract-bound DNS and SSH operations.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- Global configuration changes occur only through the user-invoked init command, and --project-only disables them.
- The cloud runner checks the declared contract, target IDs, allowed operations, and SSH host-key fingerprint before acting.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
8 flaggeddist/services/stack-git.jsView file
1import { execFile } from "node:child_process";
L2: import { createHash } from "node:crypto";
...
L5: import { promisify } from "node:util";
L6: import { inflateRawSync } from "node:zlib";
L7: import { assertSafeDestination } from "./transactional-files.js";
L8: const exec = promisify(execFile);
L9: const API = "https://api.github.com/repos/git-for-windows/git/releases/latest";
L10: const KNOWN_DIGESTS = {
...
L12: };
L13: export function resolveGitForWindowsRelease(value, arch = process.arch) {
L14: const release = value;
...
L34: try {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/services/stack-git.jsView on unpkg · L1templates/.agents/design/zaip-design.exeView file
•path = templates/.agents/design/zaip-design.exe
kind = payload_in_excluded_dir
sizeBytes = 7680
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.agents/design/zaip-design.exeView on unpkgFindings
1 Critical3 High7 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/services/doctor.js
HighSandbox Evasion Gated Capabilitydist/services/stack-git.js
HighPayload In Excluded Dirtemplates/.agents/design/zaip-design.exe
HighSemantic Analysis Limiteddist/services/codex-pre-tool-hook-template.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarytemplates/.agents/design/zaip-design.exe
MediumShips Build Helpertemplates/.agents/design/packages/windows-launcher/build-design-launcher.ps1
MediumOversized Source Filetemplates/.agents/runtime/bin/zaip.mjs
MediumOversized Cli Entrypointtemplates/.agents/runtime/bin/zaip.mjs
Affected versions and remediation
This report applies to @zaip-ai/cli@3.0.0.
See all versions of @zaip-ai/cli for other recorded verdicts.
- Review the evidence and your use of @zaip-ai/cli@3.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.