@zan_team/zan-router@1.0.1
ZAN AI Router CLI
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an explicit user-invoked agent configuration tool that persists a credential redirect to its own default service. It warrants a warning for AI-agent capability abuse, not a block, because no unconsented lifecycle mutation or concrete malicious chain was found.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A user runs zan-router setup or an agent-specific setup command and confirms the plan.
Impact
Selected agents may send future model requests to the ZAN endpoint using the supplied credential.
Mechanism
Credential verification and persistent agent-provider configuration.
AI rationale
This is an explicit user-invoked agent configuration tool that persists a credential redirect to its own default service. It warrants a warning for AI-agent capability abuse, not a block, because no unconsented lifecycle mutation or concrete malicious chain was found.
Evidence
package.jsondist/cli.jsdist/chunk-PQHNQ4Z4.js~/.claude/settings.json$CODEX_HOME/config.toml$CODEX_HOME/zan.config.toml$CODEX_HOME/zan-model-catalog.json~/.openclaw/openclaw.json~/.config/opencode/opencode.json~/.neovate/config.json$HERMES_HOME/config.yaml$HERMES_HOME/.env
Network endpoints4
ai.zan.topai.zan.top/v1/responsesai.zan.top/v1/chat/completionsai.zan.top/v1/messages
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit setup command verifies a supplied API key by sending it as an authorization header.
- After a confirmation prompt, setup configures selected third-party coding agents with the ZAN endpoint and credential.
- The default endpoint is https://ai.zan.top, and the package targets several local agent configuration files.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Configuration changes require an explicit CLI subcommand and a confirmation step.
- No remote code loading, shell download, or unrelated credential harvesting was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcedist/cli.jsView file
99Source sends the broad process environment to a literal external destination.
L99: if (this.mode === "json") {
L100: this.writeStdout(withSingleTrailingNewline(JSON.stringify(jsonValue2) ?? "null"));
L101: return;
...
L143: colorsEnabled() {
L144: return !this.noColor && process.env.NO_COLOR === void 0;
L145: }
...
L152: writeStdout: (value) => {
L153: process.stdout.write(value);
L154: },
...
L276: const onData = (buffer) => {
L277: for (const character of buffer.toString("utf8")) {
L278: if (character === "" || character === "") return finish(new SetupCancelledError());
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L99•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
openAIBaseUrl,
import readline from "readline/promises";
"API Key (Enter to keep existing, or paste a new key to replace, Ctrl+C to cancel): "
console.error("\u2717 Invalid API key format. Expected a key beginning with sk-.");
const apiKey = await readHiddenInput("Paste your ZAN API Key (Ctrl+C to cancel): ");
console.error("\u2717 Invalid API key format. Use a ZAN key beginning with sk-, or press Ctrl+C to cancel.");
const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
1 Critical4 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighKnown Malware Source Similaritydist/chunk-PQHNQ4Z4.js
HighKnown Malware Source Similaritydist/cli.js
HighKnown Malware Source Fingerprint Signaturedist/chunk-PQHNQ4Z4.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @zan_team/zan-router@1.0.1.
See all versions of @zan_team/zan-router for other recorded verdicts.
- Review the evidence and your use of @zan_team/zan-router@1.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.