registry / @zincapp/zn-vault-agent / 1.23.0

@zincapp/zn-vault-agent@1.23.0

ZnVault Certificate Agent - Real-time certificate and secret distribution

AI Security Review

scanned 9h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time behavior occurs. An explicit privileged setup creates a persistent service and root updater; a configured vault event can request package self-updates.

Static reason

No blocking static signals were detected.

Trigger

User runs `sudo zn-vault-agent setup`, then starts/configures the agent.

Impact

A configured vault or privileged local configuration can cause global package replacement; Payara mode substantially broadens the service account's sudo authority.

Mechanism

systemd persistence, vault-driven update trigger, and configured plugin loading

Rationale

The package is not concretely malicious, but it exposes dangerous privileged persistence and remote-triggered self-update capabilities. Flag as a warning for security review and deployment hardening.

Evidence

package.jsondist/commands/setup.jsdist/services/npm-auto-update.jsdist/lib/websocket.jsdeploy/scripts/zn-vault-agent-update.shdist/plugins/loader.js

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.

@zincapp/zn-vault-agent@1.23.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code