@zaip-ai/cli@6.3.0
CLI oficial para instalar e configurar o ZAIP-AIOS em qualquer repositório
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe package has no npm lifecycle hooks, while its agent configuration behavior is reachable through explicit CLI initialization and includes project-hook verification. This warrants a warning for agent configuration capability, but the inspected evidence does not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs `zaip init` without `--project-only`.
Impact
Codex hooks may run for the configured project, and ZAIP-owned global hook entries may be reconciled. No unrelated control-surface takeover was established.
Mechanism
Initialization installs project files and invokes global Codex configuration reconciliation when the required project catalog is present; reconciliation checks that project hooks are verified before changing global configuration.
AI rationale
The package has no npm lifecycle hooks, while its agent configuration behavior is reachable through explicit CLI initialization and includes project-hook verification. This warrants a warning for agent configuration capability, but the inspected evidence does not establish malicious behavior.
Evidence
dist/commands/init.jsdist/services/install-agents-template.jsdist/services/global-codex-config.js.codex/config.toml.codex/hooks/zaip-pre-tool-use.mjs
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest defines a CLI entry point and no install lifecycle hook.
- Running the explicit `zaip init` command can install project Codex hooks and update global Codex configuration unless `--project-only` is set.
- The global configuration update requires verified project hooks; it does not establish an unconsented install-time attack.
- The flagged executable is binary data, and the doctor source does not directly load it.
Evidence against
- The agent setup is activated through an explicit CLI command, rather than an npm install hook.
- No confirmed credential theft, unrelated network exfiltration, or malicious payload execution was established.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
8 flaggeddist/services/stack-git.jsView file
1import { execFile } from "node:child_process";
L2: import { createHash } from "node:crypto";
...
L5: import { promisify } from "node:util";
L6: import { inflateRawSync } from "node:zlib";
L7: import { assertSafeDestination } from "./transactional-files.js";
L8: const exec = promisify(execFile);
L9: const API = "https://api.github.com/repos/git-for-windows/git/releases/latest";
L10: const KNOWN_DIGESTS = {
...
L12: };
L13: export function resolveGitForWindowsRelease(value, arch = process.arch) {
L14: const release = value;
...
L34: try {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/services/stack-git.jsView on unpkg · L1templates/.agents/design/zaip-design.exeView file
•path = templates/.agents/design/zaip-design.exe
kind = payload_in_excluded_dir
sizeBytes = 7680
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.agents/design/zaip-design.exeView on unpkgFindings
1 Critical3 High7 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/services/doctor.js
HighSandbox Evasion Gated Capabilitydist/services/stack-git.js
HighPayload In Excluded Dirtemplates/.agents/design/zaip-design.exe
HighSemantic Analysis Limiteddist/services/codex-pre-tool-hook-template.test.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarytemplates/.agents/design/zaip-design.exe
MediumShips Build Helpertemplates/.agents/design/packages/windows-launcher/build-design-launcher.ps1
MediumOversized Source Filetemplates/.agents/runtime/bin/zaip.mjs
MediumOversized Cli Entrypointtemplates/.agents/runtime/bin/zaip.mjs
Affected versions and remediation
This report applies to @zaip-ai/cli@6.3.0.
See all versions of @zaip-ai/cli for other recorded verdicts.
- Review the evidence and your use of @zaip-ai/cli@6.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.