@zaip-ai/cli@4.0.0
CLI oficial para instalar e configurar o ZAIP-AIOS em qualquer repositório
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package does not mutate agent config during npm install, but zaip init does rewrite the global Codex control file by default and installs a PreToolUse hook. That is an explicit user-command agent capability with a project-only opt-out, so it warrants a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs zaip init without --project-only.
Impact
Later Codex tool calls can be passed through the installed local hook. No install-time execution or credential upload was found.
Mechanism
installAgentsTemplate calls reconcileGlobalCodexConfig, which rewrites ~/.codex/config.toml and appends the ZAIP PreToolUse hook.
AI rationale
The package does not mutate agent config during npm install, but zaip init does rewrite the global Codex control file by default and installs a PreToolUse hook. That is an explicit user-command agent capability with a project-only opt-out, so it warrants a warning rather than a publish block.
Evidence
dist/commands/init.jsdist/index.jsdist/services/global-codex-config.jsdist/services/codex-config-template.jsdist/services/install-agents-template.js~/.codex/config.toml.codex/hooks/zaip-pre-tool-use.mjs
Decision evidence
public snapshotAI called this Suspicious at 76.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes the zaip bin and has no preinstall, install, or postinstall script.
- zaip init turns on global Codex configuration unless the caller passes --project-only.
- reconcileGlobalCodexConfig writes CODEX_HOME or the home .codex/config.toml file.
- That writer installs a PreToolUse command hook into the global Codex config.
- installAgentsTemplate calls the global Codex writer after a template apply.
Evidence against
- The global write runs only from the explicit zaip init command, not from an npm lifecycle hook.
- --project-only skips reading or changing ~/.codex.
- The installed hook is a local command-safety policy and does not send credentials to a package endpoint.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/services/stack-git.jsView file
1import { execFile } from "node:child_process";
L2: import { createHash } from "node:crypto";
...
L5: import { promisify } from "node:util";
L6: import { inflateRawSync } from "node:zlib";
L7: import { assertSafeDestination } from "./transactional-files.js";
L8: const exec = promisify(execFile);
L9: const API = "https://api.github.com/repos/git-for-windows/git/releases/latest";
L10: const KNOWN_DIGESTS = {
...
L12: };
L13: export function resolveGitForWindowsRelease(value, arch = process.arch) {
L14: const release = value;
...
L34: try {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/services/stack-git.jsView on unpkg · L1templates/.agents/design/zaip-design.exeView file
•path = templates/.agents/design/zaip-design.exe
kind = payload_in_excluded_dir
sizeBytes = 7680
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.agents/design/zaip-design.exeView on unpkgFindings
1 Critical3 High7 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/services/doctor.js
HighSandbox Evasion Gated Capabilitydist/services/stack-git.js
HighPayload In Excluded Dirtemplates/.agents/design/zaip-design.exe
HighSemantic Analysis Limiteddist/services/codex-pre-tool-hook-template.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarytemplates/.agents/design/zaip-design.exe
MediumShips Build Helpertemplates/.agents/design/packages/windows-launcher/build-design-launcher.ps1
MediumOversized Source Filetemplates/.agents/runtime/bin/zaip.mjs
MediumOversized Cli Entrypointtemplates/.agents/runtime/bin/zaip.mjs
Affected versions and remediation
This report applies to @zaip-ai/cli@4.0.0.
See all versions of @zaip-ai/cli for other recorded verdicts.
- Review the evidence and your use of @zaip-ai/cli@4.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.