@zaip-ai/cli@3.8.0
CLI oficial para instalar e configurar o ZAIP-AIOS em qualquer repositório
AI Security Review
scanned 1mo ago · by lpm-firewall-aizaip init rewrites the user's Codex config.toml to install a first-party pre-tool hook unless --project-only is passed. That is an explicit command mutating a global agent control file, so it is a warning, and npm install has no lifecycle hook that performs the write.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs zaip init without --project-only.
Impact
The user's global Codex tool hook changes and listed legacy agent name tables can be removed. Project template files are written only as part of that same command.
Mechanism
executeInit sets installGlobalCodexConfig, and installAgentsTemplate calls reconcileGlobalCodexConfig, which reads and replaces CODEX_HOME or ~/.codex/config.toml with the bundled PreToolUse hook text.
AI rationale
zaip init rewrites the user's Codex config.toml to install a first-party pre-tool hook unless --project-only is passed. That is an explicit command mutating a global agent control file, so it is a warning, and npm install has no lifecycle hook that performs the write.
Evidence
dist/commands/init.jsdist/services/global-codex-config.jsdist/services/install-agents-template.js.codex/config.toml.agents/config/agents/catalog.yaml
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- zaip init enables installGlobalCodexConfig unless --project-only is set or a caller injects templateDirectory.
- reconcileGlobalCodexConfig defaults to CODEX_HOME or the user .codex directory and rewrites config.toml.
- The rewrite installs the ZAIP PreToolUse hook and drops catalog-listed legacy Codex agent tables.
- After copying the project template, installAgentsTemplate calls reconcileGlobalCodexConfig with the project agent catalog.
Evidence against
- package.json has a zaip bin and build/prepack scripts only; there is no preinstall, install, or postinstall hook.
- --project-only skips reading or writing ~/.codex.
- Git, Node, and Terraform downloads are user-command stack setup with official host or SHA-256 checks under the project .local directory.
- The design Windows launcher source starts a local node script and is not an install-time trigger.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
9 flaggeddist/services/stack-git.jsView file
1import { execFile } from "node:child_process";
L2: import { createHash } from "node:crypto";
...
L5: import { promisify } from "node:util";
L6: import { inflateRawSync } from "node:zlib";
L7: import { assertSafeDestination } from "./transactional-files.js";
L8: const exec = promisify(execFile);
L9: const API = "https://api.github.com/repos/git-for-windows/git/releases/latest";
L10: const KNOWN_DIGESTS = {
...
L12: };
L13: export function resolveGitForWindowsRelease(value, arch = process.arch) {
L14: const release = value;
...
L34: try {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/services/stack-git.jsView on unpkg · L1templates/.agents/design/zaip-design.exeView file
•path = templates/.agents/design/zaip-design.exe
kind = payload_in_excluded_dir
sizeBytes = 7680
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.agents/design/zaip-design.exeView on unpkgFindings
1 Critical4 High7 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/services/doctor.js
HighSandbox Evasion Gated Capabilitydist/services/stack-git.js
HighPayload In Excluded Dirtemplates/.agents/design/zaip-design.exe
HighSemantic Analysis Limiteddist/services/codex-pre-tool-hook-template.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/services/sqlite-bootstrap.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarytemplates/.agents/design/zaip-design.exe
MediumShips Build Helpertemplates/.agents/design/packages/windows-launcher/build-design-launcher.ps1
MediumOversized Source Filetemplates/.agents/runtime/bin/zaip.mjs
Medium
Affected versions and remediation
This report applies to @zaip-ai/cli@3.8.0.
See all versions of @zaip-ai/cli for other recorded verdicts.
- Review the evidence and your use of @zaip-ai/cli@3.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.