aixxai@1.5.4
AIXX CLI - 让你的AI调用万物。安装：npx aixxai install
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource establishes explicit-user-command agent configuration mutation, which the supplied policy classifies as warning-only. No npm lifecycle hijack, active archive execution, or unrelated credential exfiltration was established.
Static reason
One or more suspicious static signals were detected.
Trigger
Running aixx install or aixx i with an available or newly created AIXX key.
Impact
Subsequent Claude requests use the AIXX gateway instead of the previously configured provider; ZCode gains AIXX providers.
Mechanism
The installer copies agent skills, persists AIXX environment settings, and invokes configuration writers without a separate provider-replacement confirmation.
AI rationale
Source establishes explicit-user-command agent configuration mutation, which the supplied policy classifies as warning-only. No npm lifecycle hijack, active archive execution, or unrelated credential exfiltration was established.
Evidence
src/commands/install.jssrc/utils/agentconfig.jssrc/utils/env.jsbin/aixx.js~/.claude/settings.json~/.zcode/v2/config.json~/.aixx/config.json~/.zshrc~/.bashrc~/.bash_profile
Network endpoints1
baodan.run
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit install command invokes agent configuration whenever an AIXX key is available.
- Agent configuration replaces Claude's provider URL and token and adds or updates ZCode providers.
- The manifest has no npm install lifecycle hooks; configuration runs through the CLI install command.
- Agent configuration backs up existing settings and skips writes if backup fails.
- Shell configuration persists AIXX credentials as environment variables.
Evidence against
- The gateway receives AIXX credentials obtained from AIXX registration, package-specific storage, or user input; no unrelated credential theft was established.
- The bundled older-release archive is not referenced by the inspected installation path.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedsrc/utils/env.jsView file
4* 把AIXX_API_KEY和AIXX_BASE_URL写入用户的shell配置
L5: * 支持 bash/zsh (Linux/macOS) 和 PowerShell (Windows)
L6: */
...
L13: // 会话16换门：统一走域名入口（HTTPS加密+CORS白名单+错key锁定+余额脱敏的网关），旧IP:8080仅存量兼容
L14: const DEFAULT_BASE_URL = 'https://baodan.run/v1';
L15:
...
L31: export function loadApiKey() {
L32: if (process.env.AIXX_API_KEY) return process.env.AIXX_API_KEY;
L33: const home = homedir();
L34: for (const file of [join(home, '.aixx', 'config.json'), join(home, '.aixx', 'account.json')]) {
...
L36: try {
L37: const conf = JSON.parse(readFileSync(file, 'utf-8'));
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
src/utils/env.jsView on unpkg · L44Trigger-reachable persistence chain: manifest.bin -> bin/aixx.js -> src/commands/balance.js -> src/utils/env.js
L4: * 把AIXX_API_KEY和AIXX_BASE_URL写入用户的shell配置
L5: * 支持 bash/zsh (Linux/macOS) 和 PowerShell (Windows)
L6: */
...
L13: // 会话16换门：统一走域名入口（HTTPS加密+CORS白名单+错key锁定+余额脱敏的网关），旧IP:8080仅存量兼容
L14: const DEFAULT_BASE_URL = 'https://baodan.run/v1';
L15:
...
L31: export function loadApiKey() {
L32: if (process.env.AIXX_API_KEY) return process.env.AIXX_API_KEY;
L33: const home = homedir();
L34: for (const file of [join(home, '.aixx', 'config.json'), join(home, '.aixx', 'account.json')]) {
...
L36: try {
L37: const conf = JSON.parse(readFileSync(file, 'utf-8'));
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
src/utils/env.jsFindings
3 High5 Medium5 Low
HighSandbox Evasion Gated Capabilitysrc/utils/env.js
HighTrigger Reachable Persistencesrc/utils/env.js
HighShips High Entropy Blobaixxai-1.5.3.tgz
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/utils/env.js
MediumShips Compressed Blobaixxai-1.5.3.tgz
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectionaixxai-1.5.3.tgz
Affected versions and remediation
This report applies to aixxai@1.5.4.
See all versions of aixxai for other recorded verdicts.
- Review the evidence and your use of aixxai@1.5.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.