@zaip-ai/cli@3.6.0
CLI oficial para instalar e configurar o ZAIP-AIOS em qualquer repositório
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is not malicious install-hook behavior because the package has no automatic npm installation hook and the change is reached through `zaip init`. It warrants a warning because the default explicit command modifies global Codex configuration and installs agent hooks.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs `zaip init` without `--project-only`.
Impact
This is an explicit-user-command change to an AI-agent control surface; it can affect later Codex tool-hook behavior, but no covert execution or data theft was confirmed.
Mechanism
The initializer calls the global Codex configuration reconciler and writes managed Codex configuration and hook files.
AI rationale
This is not malicious install-hook behavior because the package has no automatic npm installation hook and the change is reached through `zaip init`. It warrants a warning because the default explicit command modifies global Codex configuration and installs agent hooks.
Evidence
dist/commands/init.jsdist/services/global-codex-config.jsdist/services/adapters.js.codex/config.toml.codex/hooks/zaip-pre-tool-use.mjs
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package exposes an explicit `zaip init` command rather than an npm install lifecycle hook.
- Running `init` enables global Codex configuration unless the user selects `--project-only`.
- The global configuration routine targets the user's Codex config file and installs a command safety hook.
- The project template writes Codex configuration and hook files into the selected repository.
Evidence against
- No package lifecycle install, preinstall, or postinstall hook was found in package metadata.
- The global mutation is reached through the user-invoked `init` command, and `--project-only` avoids it.
- No credential collection, exfiltration sink, or covert remote payload execution was identified in the inspected path.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/services/stack-git.jsView file
1import { execFile } from "node:child_process";
L2: import { createHash } from "node:crypto";
...
L5: import { promisify } from "node:util";
L6: import { inflateRawSync } from "node:zlib";
L7: import { assertSafeDestination } from "./transactional-files.js";
L8: const exec = promisify(execFile);
L9: const API = "https://api.github.com/repos/git-for-windows/git/releases/latest";
L10: const KNOWN_DIGESTS = {
...
L12: };
L13: export function resolveGitForWindowsRelease(value, arch = process.arch) {
L14: const release = value;
...
L34: try {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/services/stack-git.jsView on unpkg · L1templates/.agents/design/zaip-design.exeView file
•path = templates/.agents/design/zaip-design.exe
kind = payload_in_excluded_dir
sizeBytes = 7680
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.agents/design/zaip-design.exeView on unpkgFindings
1 Critical4 High7 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/services/doctor.js
HighSandbox Evasion Gated Capabilitydist/services/stack-git.js
HighPayload In Excluded Dirtemplates/.agents/design/zaip-design.exe
HighSemantic Analysis Limiteddist/services/codex-pre-tool-hook-template.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/services/stack-node.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarytemplates/.agents/design/zaip-design.exe
MediumShips Build Helpertemplates/.agents/design/packages/windows-launcher/build-design-launcher.ps1
MediumOversized Source Filetemplates/.agents/runtime/bin/zaip.mjs
Medium
Affected versions and remediation
This report applies to @zaip-ai/cli@3.6.0.
See all versions of @zaip-ai/cli for other recorded verdicts.
- Review the evidence and your use of @zaip-ai/cli@3.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.