aixxai@1.1.0
AIXX CLI - 让你的AI调用万物。安装：npx aixxai install
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
2 flaggedsrc/utils/env.jsView file
4Trigger-reachable persistence chain: manifest.bin -> bin/aixx.js -> src/commands/install.js -> src/utils/env.js
L4: * 把AIXX_API_KEY和AIXX_BASE_URL写入用户的shell配置
L5: * 支持 bash/zsh (Linux/macOS) 和 PowerShell (Windows)
L6: */
...
L11:
L12: // ⚠️ 安全警告：当前用HTTP明文传输API Key（http://），存在凭据被嗅探风险。
L13: // TODO（安全）：后端配置好HTTPS证书后，把下面的 URL 改为 'https://14.103.27.195:8080/v1'。
...
L16: export function setupEnv(apiKey, baseUrl = DEFAULT_BASE_URL) {
L17: const platform = process.platform;
L18: const home = homedir();
L19:
...
L40: const shellConfigs = [
L41: join(home, '.zshrc'),
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
src/utils/env.jsView on unpkg · L44* 把AIXX_API_KEY和AIXX_BASE_URL写入用户的shell配置
L5: * 支持 bash/zsh (Linux/macOS) 和 PowerShell (Windows)
L6: */
...
L11:
L12: // ⚠️ 安全警告：当前用HTTP明文传输API Key（http://），存在凭据被嗅探风险。
L13: // TODO（安全）：后端配置好HTTPS证书后，把下面的 URL 改为 'https://14.103.27.195:8080/v1'。
...
L16: export function setupEnv(apiKey, baseUrl = DEFAULT_BASE_URL) {
L17: const platform = process.platform;
L18: const home = homedir();
L19:
...
L40: const shellConfigs = [
L41: join(home, '.zshrc'),
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
src/utils/env.jsView on unpkg · L4Findings
1 High3 Medium4 Low
HighTrigger Reachable Persistencesrc/utils/env.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/utils/env.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to aixxai@1.1.0.
See all versions of aixxai for other recorded verdicts.
- Review the evidence and your use of aixxai@1.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.