@zaip-ai/cli@3.1.0
CLI oficial para instalar e configurar o ZAIP-AIOS em qualquer repositório
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a user-invoked agent and infrastructure management tool with a broad permission profile and opaque binary payload. No lifecycle execution, self-dependency chain, automatic payload activation, credential exfiltration, or malicious install hook was found.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs zaip init without --project-only, or later invokes the installed cloud runner.
Impact
The tool can broaden an AI agent's permissions and carry out approved remote infrastructure changes; no install-time compromise or secret exfiltration was confirmed.
Mechanism
User-invoked Codex hook installation and contract-gated cloud administration.
AI rationale
This is a user-invoked agent and infrastructure management tool with a broad permission profile and opaque binary payload. No lifecycle execution, self-dependency chain, automatic payload activation, credential exfiltration, or malicious install hook was found.
Evidence
dist/commands/init.jsdist/services/global-codex-config.jsdist/services/codex-config-template.jstemplates/.agents/tools/cloud-runner.mjstemplates/template-manifest.json~/.codex/config.toml.codex/config.toml.agents/config/autonomous-cloud-contract.json.agents/design/zaip-design.exe
Network endpoints3
api.github.comapi.cloudflare.comdevelopers.hostinger.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit init command enables a user-level Codex configuration update unless project-only mode is selected.
- The configuration reconciler writes a PreToolUse hook into the Codex home configuration.
- The installed project configuration defaults to unrestricted filesystem and network access.
- The package ships an opaque Windows executable in its project template.
- The cloud runner reads project credentials and can perform contract-gated DNS, Terraform, and SSH operations.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook and no self-dependency.
- The global configuration change is reached from the user-invoked init command, not package installation or import.
- The cloud runner requires an authorization-bearing contract, exact target checks, and credential inputs.
- The doctor source only checks required project files; it does not load or execute the flagged design executable.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
8 flaggeddist/services/stack-git.jsView file
1import { execFile } from "node:child_process";
L2: import { createHash } from "node:crypto";
...
L5: import { promisify } from "node:util";
L6: import { inflateRawSync } from "node:zlib";
L7: import { assertSafeDestination } from "./transactional-files.js";
L8: const exec = promisify(execFile);
L9: const API = "https://api.github.com/repos/git-for-windows/git/releases/latest";
L10: const KNOWN_DIGESTS = {
...
L12: };
L13: export function resolveGitForWindowsRelease(value, arch = process.arch) {
L14: const release = value;
...
L34: try {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/services/stack-git.jsView on unpkg · L1templates/.agents/design/zaip-design.exeView file
•path = templates/.agents/design/zaip-design.exe
kind = payload_in_excluded_dir
sizeBytes = 7680
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.agents/design/zaip-design.exeView on unpkgFindings
1 Critical3 High7 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/services/doctor.js
HighSandbox Evasion Gated Capabilitydist/services/stack-git.js
HighPayload In Excluded Dirtemplates/.agents/design/zaip-design.exe
HighSemantic Analysis Limiteddist/services/codex-pre-tool-hook-template.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarytemplates/.agents/design/zaip-design.exe
MediumShips Build Helpertemplates/.agents/design/packages/windows-launcher/build-design-launcher.ps1
MediumOversized Source Filetemplates/.agents/runtime/bin/zaip.mjs
MediumOversized Cli Entrypointtemplates/.agents/runtime/bin/zaip.mjs
Affected versions and remediation
This report applies to @zaip-ai/cli@3.1.0.
See all versions of @zaip-ai/cli for other recorded verdicts.
- Review the evidence and your use of @zaip-ai/cli@3.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.