registry / @zan_team/zan-router / 1.0.0

@zan_team/zan-router@1.0.0

ZAN AI Router CLI

AI Security Review

scanned 1h ago · by lpm-firewall-ai

A user-invoked setup can read a pre-existing Claude or Hermes credential and transmit it to ZAN before confirmation. It then redirects selected agent configuration to ZAN.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Running zan-router setup, auto, or an agent setup subcommand on an existing Claude/Hermes configuration.

Impact

A non-ZAN Anthropic or OpenAI credential may be disclosed to the ZAN service and agent traffic can be redirected there.

Mechanism

credential harvesting from agent configs followed by pre-confirmation API verification and endpoint redirection

Attack narrative

On setup, the CLI reads existing agent keys before obtaining user confirmation. For Claude it accepts ANTHROPIC_AUTH_TOKEN without checking that it is a prior ZAN credential; for Hermes it can accept OPENAI_API_KEY. It then verifies the key by POSTing it in authorization headers to the default ZAN endpoint. Only after this network transmission does the CLI display its review/apply confirmation and write provider redirection settings.

Rationale

This is concrete credential exfiltration from foreign agent configuration to a package-controlled endpoint before consent, not merely an explicit configuration helper.

Evidence

dist/cli.jsdist/chunk-LRKSX7C5.jspackage.json~/.claude/settings.json~/.hermes/.env~/.codex/config.toml~/.openclaw/openclaw.json~/.config/opencode/opencode.json~/.neovate/config.json

Network endpoints

1

ai.zan.top/v1

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

Setup reads credentials from existing agent configs before the user confirms changes.
Claude extraction accepts any existing ANTHROPIC_AUTH_TOKEN; Hermes also falls back to OPENAI_API_KEY.
The extracted key is sent as an Authorization/x-api-key header to the ZAN API.
The default receiver is https://ai.zan.top, and confirmation occurs only after verification.

Evidence against

package.json has no npm lifecycle hooks.
Network requests are confined to the advertised ZAN endpoint and setup is user-invoked.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 6 file(s), 100 KB of source, external domains: ai.zan.top, opencode.ai

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 79-119javascript

79 this.streams = options.streams;

80 }

81 configure(options) {

82 if (options.mode !== void 0) {

83

Source & flagged code

4 flagged · loading source

dist/cli.jsView file

99Source sends the broad process environment to a literal external destination. L99: if (this.mode === "json") { L100: this.writeStdout(withSingleTrailingNewline(JSON.stringify(jsonValue2) ?? "null")); L101: return; ... L143: colorsEnabled() { L144: return !this.noColor && process.env.NO_COLOR === void 0; L145: } ... L152: writeStdout: (value) => { L153: process.stdout.write(value); L154: }, ... L276: const onData = (buffer) => { L277: for (const character of buffer.toString("utf8")) { L278: if (character === "" || character === "") return finish(new SetupCancelledError());

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L99

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: openAIBaseUrl, import readline from "readline/promises"; "API Key (Enter to keep existing, or paste a new key to replace, Ctrl+C to cancel): " console.error("\u2717 Invalid API key format. Expected a key beginning with sk-."); const apiKey = await readHiddenInput("Paste your ZAN API Key (Ctrl+C to cancel): "); console.error("\u2717 Invalid API key format. Use a ZAN key beginning with sk-, or press Ctrl+C to cancel."); const rl = readline.createInterface({ input: process.stdin, output: process.stdout }); const rl = readline.createInterface({ input: process.stdin, output: process.stdout });

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

Findings

1 Critical3 High3 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/cli.js

HighCredential Redirect Persistencedist/cli.js

HighAi Review Evidencedist/cli.js

HighAi Review Evidencedist/chunk-LRKSX7C5.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LPM CLI

dist/cli.js

View on unpkg

1437const { readAgentApiKey: readAgentApiKey2 } = await import("./inspect-OW4NQGNL.js"); const [existingKeys, existingInspections] = await Promise.all([ Promise.all(agents.map((agent) => readAgentApiKey2(agent))), Promise.all(agents.map((agent) => inspectAgentConfig(agent, {}, detected))) ]); const alreadyConfigured = existingKeys.some((k) => k !== null); const existingKey = existingKeys.find((k) => k !== null) ?? null; if (alreadyConfigured) {

High

Ai Review Evidence

Setup reads credentials from existing agent configs before the user confirms changes.

dist/cli.jsView on unpkg · L1437

dist/chunk-LRKSX7C5.jsView file

348async function readAgentApiKey(agent) { try { if (agent === "claude-code") { const source = await readOptional(claudeSettingsPath()); if (!source) return null; const settings = JSON.parse(source); return settings.env?.ANTHROPIC_AUTH_TOKEN ?? null; }

High

Ai Review Evidence

Claude extraction accepts any existing ANTHROPIC_AUTH_TOKEN; Hermes also falls back to OPENAI_API_KEY.

dist/chunk-LRKSX7C5.jsView on unpkg · L348

Network

Shell

HighEntropyStrings

UrlStrings

NoLicense

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 79-119javascript

79 this.streams = options.streams;

80 }

81 configure(options) {

82 if (options.mode !== void 0) {

83

this

.mode

=

options.mode;

84 }

85 if (options.quiet !== void 0) {

86 this.quiet = options.quiet;

87 }

88 if (options.noColor !== void 0) {

89 this.noColor = options.noColor;

90 }

91 }

92 suppress() {

93 this.suppressed = true;

94 }

95 success(jsonValue2, humanText) {

96 if (this.suppressed) {

97 return;

98 }

99 if (this.mode === "json") {

100 this.writeStdout(withSingleTrailingNewline(JSON.stringify(jsonValue2) ?? "null"));

101 return;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L99

102 }

103 const text = humanText ?? (typeof jsonValue2 === "string" ? jsonValue2 : JSON.stringify(jsonValue2));

104 this.writeStdout(withSingleTrailingNewline(text ?? ""));

105 }

106 failure(failure) {

107 if (this.suppressed) {

108 return;

109 }

110 const message = redactSensitiveText(failure.message);

111 const hint = failure.hint === void 0 ? void 0 : redactSensitiveText(failure.hint);

112 if (this.mode === "json") {

113 const error = hint === void 0 ? { code: failure.code, message, retryable: failure.retryable } : { code: failure.code, message, hint, retryable: failure.retryable };

114 this.writeStderr(`${JSON.stringify({ error })}

115`);

116 return;

117 }

118 const lines = [`${failure.code}: ${message}`];

119 if (hint !== void 0) {

Lines 1417-1457javascript

1417 agents = await selectedAgents(options, detected);

1418 for (const agent of agents) {

1419 if (detected[agent] !== "installed") {

1420 throw new

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: openAIBaseUrl, import readline from "readline/promises"; "API Key (Enter to keep existing, or paste a new key to replace, Ctrl+C to cancel): " console.error("\u2717 Invalid API key format. Expected a key beginning with sk-."); const apiKey = await readHiddenInput("Paste your ZAN API Key (Ctrl+C to cancel): "); console.error("\u2717 Invalid API key format. Use a ZAN key beginning with sk-, or press Ctrl+C to cancel."); const rl = readline.createInterface({ input: process.stdin, output: process.stdout }); const rl = readline.createInterface({ input: process.stdin, output: process.stdout });

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

dist/chunk-LRKSX7C5.jsView file

Lines 328-368javascript

328 const primary = config?.agents?.defaults?.model?.primary;

329 result.model_id = primary?.startsWith("zan/") ? primary.slice(4) : result.model_id;

330 result.model_name = result.model_id

CliFailure

(

"SETUP_REQUIRED"

,

`${

agent

} was not found on this machine.`

);

1421 }

1422 }

1423 }

1424 if (agents.length === 0) throw new CliFailure("INVALID_ARGS", "No supported agents were selected.");

1425 printStep(output, reviewStep, totalSteps, "Paste and verify API key");

1426 const compatible = await resolveCompatibleModel({

1427 agents,

1428 model: options.model,

1429 baseUrl: options.baseUrl

1430 });

1431 if (!compatible) {

1432 output.writeStdout("Setup cancelled. No credentials or configuration files were changed.\n");

1433 return;

1434 }

1435 let modelName = compatible.modelEntry?.display_name ?? compatible.model;

1436 options.model = compatible.model;

1437 const { readAgentApiKey: readAgentApiKey2 } = await import("./inspect-OW4NQGNL.js");

1438 const [existingKeys, existingInspections] = await Promise.all([

1439 Promise.all(agents.map((agent) => readAgentApiKey2(agent))),

1440 Promise.all(agents.map((agent) => inspectAgentConfig(agent, {}, detected)))

1441 ]);

1442 const alreadyConfigured = existingKeys.some((k) => k !== null);

1443 const existingKey = existingKeys.find((k) => k !== null) ?? null;

1444 if (alreadyConfigured) {

High

Ai Review Evidence

Setup reads credentials from existing agent configs before the user confirms changes.

dist/cli.jsView on unpkg · L1437

1445 output.writeStdout(` (These agents are already configured. Press Enter to keep existing settings.)

1446`);

1447 }

1448 const initialApiKey = await resolveApiKey(agents, alreadyConfigured);

1449 const effectiveInitialKey = initialApiKey ?? existingKey;

1450 if (!effectiveInitialKey) {

1451 throw new CliFailure("SETUP_REQUIRED", "No API key is available. Run setup and paste a ZAN API key.");

1452 }

1453 const verified = await verifyWithRecovery({

1454 agents,

1455 apiKey: effectiveInitialKey,

1456 baseUrl: options.baseUrl,

1457 model: options.model

?

provider?.models?.

find

((

model

)

=>

model.id

===

result.model_id)?.name

??

result.model_name

:

result.model_name;

331 }

332 } else if (agent === "hermes") {

333 const source = await readOptional(hermesPaths().config) ?? "";

334 const modelSection = source.match(/^model:\n((?:[ \t]+\S.*\n?)*)/mu)?.[1] ?? "";

335 const providersSection = source.match(/^providers:\n((?:[ \t]+\S.*\n?)*)/mu)?.[1] ?? "";

336 const zanSection = providersSection.match(/^ {2}zan:\n((?:[ \t]{4,}\S.*\n?)*)/mu)?.[1] ?? "";

337 result.configured = /provider:\s*zan/u.test(modelSection) && /base_url:\s*https:\/\//u.test(zanSection);

338 result.base_url = zanSection.match(/base_url:\s*(\S+)/u)?.[1] ?? result.base_url;

339 result.model_id = modelSection.match(/default:\s*(\S+)/u)?.[1] ?? result.model_id;

340 }

341 } catch (error) {

342 result.config_valid = false;

343 result.issues.push(`Invalid configuration: ${error instanceof Error ? error.message : String(error)}`);

344 }

345 if (!result.configured && result.config_valid) result.issues.push("ZAN configuration was not found.");

346 return result;

347}

348async function readAgentApiKey(agent) {

349 try {

350 if (agent === "claude-code") {

351 const source = await readOptional(claudeSettingsPath());

352 if (!source) return null;

353 const settings = JSON.parse(source);

354 return settings.env?.ANTHROPIC_AUTH_TOKEN ?? null;

355 }

High

Ai Review Evidence

Claude extraction accepts any existing ANTHROPIC_AUTH_TOKEN; Hermes also falls back to OPENAI_API_KEY.

dist/chunk-LRKSX7C5.jsView on unpkg · L348

356 if (agent === "opencode") {

357 const source = await readOptional(openCodeConfigPath());

358 if (!source) return null;

359 const config = JSON.parse(source);

360 return config.provider?.zan?.options?.apiKey ?? null;

361 }

362 if (agent === "neovate") {

363 const source = await readOptional(neovateConfigPath());

364 if (!source) return null;

365 const config = JSON.parse(source);

366 return config.provider?.zan?.options?.apiKey ?? null;

367 }

368 if (agent === "openclaw") {