registry / Credential exfiltration / @zan_team/zan-router
@zan_team/zan-router
ZAN AI Router CLI
This report shows the evidence for @zan_team/zan-router@1.0.0. 1 of 6 known versions is blocked or flagged. The newest version, 1.1.2, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is concrete credential exfiltration from foreign agent configuration to a package-controlled endpoint before consent, not merely an explicit configuration helper.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running zan-router setup, auto, or an agent setup subcommand on an existing Claude/Hermes configuration.
Impact
A non-ZAN Anthropic or OpenAI credential may be disclosed to the ZAN service and agent traffic can be redirected there.
Mechanism
credential harvesting from agent configs followed by pre-confirmation API verification and endpoint redirection
Attack narrative
On setup, the CLI reads existing agent keys before obtaining user confirmation. For Claude it accepts ANTHROPIC_AUTH_TOKEN without checking that it is a prior ZAN credential; for Hermes it can accept OPENAI_API_KEY. It then verifies the key by POSTing it in authorization headers to the default ZAN endpoint. Only after this network transmission does the CLI display its review/apply confirmation and write provider redirection settings.
AI rationale
This is concrete credential exfiltration from foreign agent configuration to a package-controlled endpoint before consent, not merely an explicit configuration helper.
Evidence
dist/cli.jsdist/chunk-LRKSX7C5.jspackage.json~/.claude/settings.json~/.hermes/.env~/.codex/config.toml~/.openclaw/openclaw.json~/.config/opencode/opencode.json~/.neovate/config.json
Network endpoints1
ai.zan.top/v1
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- Setup reads credentials from existing agent configs before the user confirms changes.
- Claude extraction accepts any existing ANTHROPIC_AUTH_TOKEN; Hermes also falls back to OPENAI_API_KEY.
- The extracted key is sent as an Authorization/x-api-key header to the ZAN API.
- The default receiver is https://ai.zan.top, and confirmation occurs only after verification.
Evidence against
- package.json has no npm lifecycle hooks.
- Network requests are confined to the advertised ZAN endpoint and setup is user-invoked.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourcedist/cli.jsView file
99Source sends the broad process environment to a literal external destination.
L99: if (this.mode === "json") {
L100: this.writeStdout(withSingleTrailingNewline(JSON.stringify(jsonValue2) ?? "null"));
L101: return;
...
L143: colorsEnabled() {
L144: return !this.noColor && process.env.NO_COLOR === void 0;
L145: }
...
L152: writeStdout: (value) => {
L153: process.stdout.write(value);
L154: },
...
L276: const onData = (buffer) => {
L277: for (const character of buffer.toString("utf8")) {
L278: if (character === "" || character === "") return finish(new SetupCancelledError());
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L99•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
openAIBaseUrl,
import readline from "readline/promises";
"API Key (Enter to keep existing, or paste a new key to replace, Ctrl+C to cancel): "
console.error("\u2717 Invalid API key format. Expected a key beginning with sk-.");
const apiKey = await readHiddenInput("Paste your ZAN API Key (Ctrl+C to cancel): ");
console.error("\u2717 Invalid API key format. Use a ZAN key beginning with sk-, or press Ctrl+C to cancel.");
const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
1 Critical3 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighAi Review Evidencedist/cli.js
HighAi Review Evidencedist/chunk-LRKSX7C5.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @zan_team/zan-router@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @zan_team/zan-router@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.