registry / @zaip-ai/cli / 5.1.0
@zaip-ai/cli@5.1.0
⚠ Under reviewCLI oficial para instalar e configurar o ZAIP-AIOS em qualquer repositório
AI Security Review
scanned 28d ago · by lpm-firewall-aiInspection found no install lifecycle trigger or confirmed malicious behavior. The shipped design executable was unreadable as source, leaving its behavior unresolved; mark_clean also requires more citations than the output limit allows.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The binary may run when a user opens the design launcher; its executable behavior could not be established from readable source.
Impact
No malicious effect was confirmed; the binary’s behavior remains unknown.
Mechanism
The package includes a Windows executable in its design template, but the source reader rejected the binary and the flagged doctor code only checks for required design files.
AI rationale
Inspection found no install lifecycle trigger or confirmed malicious behavior. The shipped design executable was unreadable as source, leaving its behavior unresolved; mark_clean also requires more citations than the output limit allows.
Evidence
templates/.agents/design/zaip-design.exedist/services/doctor.js
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest defines a CLI entry point and has no preinstall, install, or postinstall hook; its prepack script is a build and packaging workflow.
- The `doctor.js` flagged path only checks for required design files; it contains no loading of the flagged executable.
- Windows Git setup is invoked by project setup, fetches release metadata from GitHub, validates the download host and SHA-256, and extracts into the project’s `.local` directory.
- The agent configuration locations inspected are tests, fixtures, or a list of hook paths; they do not establish an install-time agent configuration mutation.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
9 flaggeddist/services/stack-git.jsView file
1import { execFile } from "node:child_process";
L2: import { createHash } from "node:crypto";
...
L5: import { promisify } from "node:util";
L6: import { inflateRawSync } from "node:zlib";
L7: import { assertSafeDestination } from "./transactional-files.js";
L8: const exec = promisify(execFile);
L9: const API = "https://api.github.com/repos/git-for-windows/git/releases/latest";
L10: const KNOWN_DIGESTS = {
...
L12: };
L13: export function resolveGitForWindowsRelease(value, arch = process.arch) {
L14: const release = value;
...
L34: try {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/services/stack-git.jsView on unpkg · L1templates/.agents/design/zaip-design.exeView file
•path = templates/.agents/design/zaip-design.exe
kind = payload_in_excluded_dir
sizeBytes = 7680
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.agents/design/zaip-design.exeView on unpkgFindings
1 Critical4 High7 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/services/doctor.js
HighSandbox Evasion Gated Capabilitydist/services/stack-git.js
HighPayload In Excluded Dirtemplates/.agents/design/zaip-design.exe
HighSemantic Analysis Limiteddist/services/codex-pre-tool-hook-template.test.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/services/codex-pre-tool-hook-template.test.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarytemplates/.agents/design/zaip-design.exe
MediumShips Build Helpertemplates/.agents/design/packages/windows-launcher/build-design-launcher.ps1
MediumOversized Source Filetemplates/.agents/runtime/bin/zaip.mjs
Affected versions and remediation
This report applies to @zaip-ai/cli@5.1.0.
See all versions of @zaip-ai/cli for other recorded verdicts.
- Review the evidence and your use of @zaip-ai/cli@5.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.