aixxai
AIXX CLI - 让你的AI调用万物。One command, every AI model. By AIXX (Wanan Exchange), the verification-first compute exchange. 安装：npx aixxai
This report shows the evidence for aixxai@1.6.8. 0 of 23 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe install flow silently sends a stable, hostname-derived device identifier to the vendor service. This is an identifying data collection concern, but the observed request goes to the package's own service and does not establish credential exfiltration or a malicious attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Running aixx install, or invoking the CLI without a subcommand, which defaults to install.
Impact
The vendor can correlate installations by device; the fingerprint includes a hostname-derived identifier. No third-party credential theft was identified.
Mechanism
Hashes hostname and machine characteristics into a device ID, then POSTs it to the vendor service during registration.
AI rationale
The install flow silently sends a stable, hostname-derived device identifier to the vendor service. This is an identifying data collection concern, but the observed request goes to the package's own service and does not establish credential exfiltration or a malicious attack.
Evidence
src/commands/install.jsbin/aixx.jspackage.json~/.aixx/config.json~/.aixx/account.json~/.zshrc~/.bashrc~/.bash_profile~/.claude/settings.json
Network endpoints2
console.aixx.ai/cloudpay/bindcode/newconsole.aixx.ai/bridge/naked/register
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The install command derives a stable fingerprint from hostname, OS, architecture, CPU count and memory.
- It posts the fingerprint as a device ID to console.aixx.ai during naked registration.
- Running the CLI without a subcommand starts the install command.
- The manifest declares no install lifecycle hook; its only npm script is test.
Evidence against
- The fingerprint is hashed before transmission, and the observed destination is the package's own service.
- No automatic transmission of a third-party credential was identified; the API key is used with AIXX's own service.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedsrc/utils/env.jsView file
4Trigger-reachable persistence chain: manifest.bin -> bin/aixx.js -> src/commands/balance.js -> src/utils/env.js
L4: * 把AIXX_API_KEY和AIXX_BASE_URL写入用户的shell配置
L5: * 支持 bash/zsh (Linux/macOS) 和 PowerShell (Windows)
L6: */
...
L14: // 后端地址统一走萬安云域名网关（账号管理与模型调用）
L15: const DEFAULT_BASE_URL = 'https://console.aixx.ai/v1';
L16:
...
L32: export function loadApiKey() {
L33: if (process.env.AIXX_API_KEY) return process.env.AIXX_API_KEY;
L34: const home = homedir();
L35: for (const file of [join(home, '.aixx', 'config.json'), join(home, '.aixx', 'account.json')]) {
...
L37: try {
L38: const conf = JSON.parse(readFileSync(file, 'utf-8'));
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
src/utils/env.jsView on unpkg · L44* 把AIXX_API_KEY和AIXX_BASE_URL写入用户的shell配置
L5: * 支持 bash/zsh (Linux/macOS) 和 PowerShell (Windows)
L6: */
...
L14: // 后端地址统一走萬安云域名网关（账号管理与模型调用）
L15: const DEFAULT_BASE_URL = 'https://console.aixx.ai/v1';
L16:
...
L32: export function loadApiKey() {
L33: if (process.env.AIXX_API_KEY) return process.env.AIXX_API_KEY;
L34: const home = homedir();
L35: for (const file of [join(home, '.aixx', 'config.json'), join(home, '.aixx', 'account.json')]) {
...
L37: try {
L38: const conf = JSON.parse(readFileSync(file, 'utf-8'));
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
src/utils/env.jsView on unpkg · L4Findings
4 High4 Medium4 Low
HighHost Fingerprint Exfiltrationsrc/commands/install.js
HighCredential Redirect Persistencesrc/commands/install.js
HighSandbox Evasion Gated Capabilitysrc/commands/install.js
HighTrigger Reachable Persistencesrc/utils/env.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/utils/env.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to aixxai@1.6.8.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of aixxai@1.6.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.