@zaip-ai/cli@7.1.0
OpenSSF/OSV Malicious Advisory
imported 7d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18364 confirms this npm version as malicious.
Advisory
MAL-2026-18364
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @zaip-ai/cli (npm)
Details
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
References
Independent LPM AI assessment
Manual ReviewIndependent AI assessment: manual_review. LPM AI review remains unresolved.
The launcher is shipped for explicit user activation, but its executable behavior could not be inspected because the offline analyzer does not support its format. Since that leaves material behavior unresolved, manual review is appropriate without claiming a confirmed attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The explicit `init` command installs the template; opening the launcher on Windows activates it.
Impact
The launcher’s effects remain unknown; source inspection did not establish a harmful effect.
Mechanism
The README says the launcher starts a hidden runtime, but its executable behavior could not be established from the available inspection.
AI rationale
The launcher is shipped for explicit user activation, but its executable behavior could not be inspected because the offline analyzer does not support its format. Since that leaves material behavior unresolved, manual review is appropriate without claiming a confirmed attack.
Evidence
templates/.agents/design/design-system-maker/zaip-design-system-maker.exe.lpm-inspection-z5C73a/0-98b39bfeacf7.txt
Independent scan evidence
public snapshotAI called this Manual Review at 82.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest lists build, clean, typecheck, template sync, and prepack scripts; `init` is an explicit CLI command, with no install lifecycle hook shown.
- The template manifest includes the Windows launcher as a binary, and its README says to open it on Windows; the offline analysis could not inspect its executable behavior.
- The offline analysis reports a 12,800-byte artifact and an unsupported executable format, leaving the launcher’s behavior unresolved.
- The agent-related source matches were inspected: they concern Codex setup or activation and test or fixture code; the setup template checks for a host session transcript.
- The doctor source was inspected alongside its scanner finding; no source-established attack behavior was confirmed.
Evidence against
- The package source does not establish malicious behavior by the launcher.
- The README describes the launcher as user-opened and starting a hidden runtime, but that description does not resolve the executable’s behavior.
Behavioral surface
ChildProcessCrypto
Source & flagged code
9 flaggeddist/services/stack-git.jsView file
1import { execFile } from "node:child_process";
L2: import { createHash } from "node:crypto";
...
L5: import { promisify } from "node:util";
L6: import { inflateRawSync } from "node:zlib";
L7: import { assertSafeDestination } from "./transactional-files.js";
L8: const exec = promisify(execFile);
L9: const API = "https://api.github.com/repos/git-for-windows/git/releases/latest";
L10: const KNOWN_DIGESTS = {
...
L12: };
L13: export function resolveGitForWindowsRelease(value, arch = process.arch) {
L14: const release = value;
...
L34: try {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/services/stack-git.jsView on unpkg · L1templates/.agents/design/design-system-maker/zaip-design-system-maker.exeView file
•path = templates/.agents/design/design-system-maker/zaip-design-system-maker.exe
kind = payload_in_excluded_dir
sizeBytes = 12800
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
Findings
1 Critical4 High7 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/services/doctor.js
HighSandbox Evasion Gated Capabilitydist/services/stack-git.js
HighPayload In Excluded Dirtemplates/.agents/design/design-system-maker/zaip-design-system-maker.exe
HighSemantic Analysis Limiteddist/services/codex-pre-tool-hook-template.test.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/services/codex-pre-tool-hook-template.test.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarytemplates/.agents/design/design-system-maker/zaip-design-system-maker.exe
MediumShips Build Helpertemplates/.agents/design/packages/windows-launcher/build-design-launcher.ps1
MediumOversized Source File
Affected versions and remediation
This report applies to @zaip-ai/cli@7.1.0.
See all versions of @zaip-ai/cli for other recorded verdicts.
- Avoid installing @zaip-ai/cli@7.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.