@zuplo/cli@7.12.0
<p align="center"> <a href="https://zuplo.com"> <img src="https://portal.zuplo.com/zuplo.svg" height="96"> <h3 align="center">Zuplo</h3> </a> </p> <p align="center">Zuplo's API Gateway helps small and large teams get APIs to production that ar
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe default request is package-aligned, but an unrestricted endpoint override can receive a saved Zuplo token or supplied API key. This is conditional credential exposure warranting a warning, not evidence of a hidden default transfer.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running `zup info` or `zup project info` with saved credentials or an API key and a custom `ZUPLO_DEVELOPER_API_ENDPOINT`.
Impact
A custom endpoint can receive the Zuplo token; the source does not establish that this happens with the default configuration.
Mechanism
The handler sends `argv.authToken` as a bearer token to the configured endpoint without validating its host.
AI rationale
The default request is package-aligned, but an unrestricted endpoint override can receive a saved Zuplo token or supplied API key. This is conditional credential exposure warranting a warning, not evidence of a hidden default transfer.
Evidence
dist/project/info/handler.jsdist/common/settings.jsdist/common/middleware/authentication.jsdist/cmds/info.jsdist/cmds/project/info.js
Network endpoints1
dev.zuplo.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The project info handler sends `argv.authToken` as a bearer token to a URL built from the developer API endpoint setting.
- The endpoint can be overridden through `ZUPLO_DEVELOPER_API_ENDPOINT`; the request has no visible host restriction, so an override can direct the token elsewhere.
- Authentication puts either a saved token or a supplied API key into `argv.authToken`.
- Both info commands reach the shared info handler; project info authenticates when a project is linked, and the `info` alias uses the same options.
- The request’s default destination is Zuplo’s developer service, and the API key is an explicit command option.
Evidence against
- Without an endpoint override, the request targets `https://dev.zuplo.com`, consistent with the CLI’s developer API.
- The source does not establish a package-selected unrelated default recipient or a hidden token transfer.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
21 flaggeddist/source/ai-gateway/files.jsView file
1import { execFile } from "node:child_process";
L2: import { randomUUID } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/source/ai-gateway/files.jsView on unpkg · L1dist/source/migrate/dev-portal/handler.jsView file
20};
L21: const execAsync = promisify(exec);
L22: export const migrateDevPortal = async (args) => {
High
Shell
Package source references shell execution.
dist/source/migrate/dev-portal/handler.jsView on unpkg · L20node_modules/pino/benchmarks/utils/wrap-log-level.jsView file
Findings
3 Critical11 High8 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationnode_modules/@zuplo/runtime/out/esm/chunk-NENTIKLL.js
CriticalCredential Exfiltrationnode_modules/@zuplo/core/zeno.js
CriticalTrojan Source Unicodenode_modules/@zuplo/editor/dist/client/static/js/codemirror-6ITIKbGP.js
HighChild Processdist/source/ai-gateway/files.js
HighShelldist/source/migrate/dev-portal/handler.js
HighSame File Env Network Executionnode_modules/@zuplo/core/customer.cli.minified.js
HighCredential Redirect Persistencenode_modules/@zuplo/core/customer.cli.minified.js
HighCommand Output Exfiltrationnode_modules/@zuplo/core/customer.cli.minified.js
HighCloud Metadata Accessnode_modules/@zuplo/runtime/out/esm/chunk-NENTIKLL.js
Affected versions and remediation
This report applies to @zuplo/cli@7.12.0.
See all versions of @zuplo/cli for other recorded verdicts.
- Review the evidence and your use of @zuplo/cli@7.12.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.