@zaip-ai/cli@5.5.0
CLI oficial para instalar e configurar o ZAIP-AIOS em qualquer repositório
AI Security Review
scanned 27d ago · by lpm-firewall-aiSource inspection supports a warning for first-party agent setup capability, including a conditional global Codex configuration reconciliation path. No npm install trigger or concrete malicious behavior was established.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A caller invokes the initialization or agent-template installation flow.
Impact
Agent guidance and hooks may be configured for the project, with possible global Codex configuration changes; no credential theft or remote execution was established.
Mechanism
The installer writes managed project agent files and may reconcile global Codex configuration under its option and template conditions.
AI rationale
Source inspection supports a warning for first-party agent setup capability, including a conditional global Codex configuration reconciliation path. No npm install trigger or concrete malicious behavior was established.
Evidence
dist/index.jsdist/services/adapters.jsdist/services/install-agents-template.jsdist/services/codex-hook-activation.js.codex/config.toml.codex/hooks/zaip-pre-tool-use.mjs.codex/hooks/zaip-hook-activation.mjsAGENTS.md.codex/skills/zaip-aios/SKILL.md.claude/skills/zaip-aios/SKILL.md
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package has no preinstall, install, or postinstall hook; its listed scripts are build and packaging tasks.
- The exported initialization function invokes the agent-template installer when called.
- The adapter code writes managed guidance and skills into Codex and Claude configuration paths.
- The installer can also reconcile global Codex configuration when its option and template conditions permit it.
Evidence against
- The package manifest exposes a CLI and has no npm lifecycle installation hook, so the agent configuration behavior is not triggered merely by installing the package.
- The reviewed excerpts show managed first-party ZAIP files and a gated global Codex reconciliation path, not an unrelated credential recipient or remote payload execution.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/services/stack-git.jsView file
1import { execFile } from "node:child_process";
L2: import { createHash } from "node:crypto";
...
L5: import { promisify } from "node:util";
L6: import { inflateRawSync } from "node:zlib";
L7: import { assertSafeDestination } from "./transactional-files.js";
L8: const exec = promisify(execFile);
L9: const API = "https://api.github.com/repos/git-for-windows/git/releases/latest";
L10: const KNOWN_DIGESTS = {
...
L12: };
L13: export function resolveGitForWindowsRelease(value, arch = process.arch) {
L14: const release = value;
...
L34: try {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/services/stack-git.jsView on unpkg · L1templates/.agents/design/zaip-design.exeView file
•path = templates/.agents/design/zaip-design.exe
kind = payload_in_excluded_dir
sizeBytes = 7680
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.agents/design/zaip-design.exeView on unpkgFindings
1 Critical4 High7 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/services/doctor.js
HighSandbox Evasion Gated Capabilitydist/services/stack-git.js
HighPayload In Excluded Dirtemplates/.agents/design/zaip-design.exe
HighSemantic Analysis Limiteddist/services/codex-pre-tool-hook-template.test.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/services/codex-pre-tool-hook-template.test.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarytemplates/.agents/design/zaip-design.exe
MediumShips Build Helpertemplates/.agents/design/packages/windows-launcher/build-design-launcher.ps1
MediumOversized Source Filetemplates/.agents/runtime/bin/zaip.mjs
Affected versions and remediation
This report applies to @zaip-ai/cli@5.5.0.
See all versions of @zaip-ai/cli for other recorded verdicts.
- Review the evidence and your use of @zaip-ai/cli@5.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.