aixxai@1.5.5
AIXX CLI - 让你的AI调用万物。安装：npx aixxai install
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source establishes explicit-user-command agent configuration mutation, which warrants a warning under the supplied policy. Backup safeguards and the absence of npm install hooks do not remove the provider replacement capability, but the inspected behavior does not justify a malware block.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs aixx install or aixx i.
Impact
Later Claude Code requests can use the AIXX gateway instead of the previously configured provider; restoring the backup reverses the change.
Mechanism
The command obtains an AIXX key, backs up existing agent settings, and writes the gateway URL and authentication token into Claude Code configuration.
AI rationale
The source establishes explicit-user-command agent configuration mutation, which warrants a warning under the supplied policy. Backup safeguards and the absence of npm install hooks do not remove the provider replacement capability, but the inspected behavior does not justify a malware block.
Evidence
bin/aixx.jssrc/commands/install.jssrc/utils/agentconfig.js~/.claude/settings.json~/.zcode/v2/config.json~/.aixx/backups/
Network endpoints1
baodan.run
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest has no npm install lifecycle hooks; agent setup is activated by the explicit CLI install command.
- The install command calls configureAgents after obtaining an AIXX API key, without a separate configuration consent prompt.
- Agent setup overwrites the existing Claude Code authentication token and provider URL in the user's settings file.
- The replacement provider points to https://baodan.run; existing settings are backed up before modification.
Evidence against
- The inspected credential flow creates or accepts an AIXX credential for the package gateway, rather than harvesting an existing Claude session.
- Configuration changes require an explicit CLI command and stop if the settings backup fails.
- The bundled older release has no install lifecycle hook or runtime self-dependency in its inspected manifest.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
7 flaggedsrc/utils/env.jsView file
4* 把AIXX_API_KEY和AIXX_BASE_URL写入用户的shell配置
L5: * 支持 bash/zsh (Linux/macOS) 和 PowerShell (Windows)
L6: */
...
L13: // 会话16换门：统一走域名入口（HTTPS加密+CORS白名单+错key锁定+余额脱敏的网关），旧IP:8080仅存量兼容
L14: const DEFAULT_BASE_URL = 'https://baodan.run/v1';
L15:
...
L31: export function loadApiKey() {
L32: if (process.env.AIXX_API_KEY) return process.env.AIXX_API_KEY;
L33: const home = homedir();
L34: for (const file of [join(home, '.aixx', 'config.json'), join(home, '.aixx', 'account.json')]) {
...
L36: try {
L37: const conf = JSON.parse(readFileSync(file, 'utf-8'));
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
src/utils/env.jsView on unpkg · L44Trigger-reachable persistence chain: manifest.bin -> bin/aixx.js -> src/commands/balance.js -> src/utils/env.js
L4: * 把AIXX_API_KEY和AIXX_BASE_URL写入用户的shell配置
L5: * 支持 bash/zsh (Linux/macOS) 和 PowerShell (Windows)
L6: */
...
L13: // 会话16换门：统一走域名入口（HTTPS加密+CORS白名单+错key锁定+余额脱敏的网关），旧IP:8080仅存量兼容
L14: const DEFAULT_BASE_URL = 'https://baodan.run/v1';
L15:
...
L31: export function loadApiKey() {
L32: if (process.env.AIXX_API_KEY) return process.env.AIXX_API_KEY;
L33: const home = homedir();
L34: for (const file of [join(home, '.aixx', 'config.json'), join(home, '.aixx', 'account.json')]) {
...
L36: try {
L37: const conf = JSON.parse(readFileSync(file, 'utf-8'));
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
src/utils/env.jsFindings
4 High5 Medium5 Low
HighCredential Redirect Persistencesrc/commands/install.js
HighSandbox Evasion Gated Capabilitysrc/utils/env.js
HighTrigger Reachable Persistencesrc/utils/env.js
HighShips High Entropy Blobaixxai-1.5.3.tgz
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/utils/env.js
MediumShips Compressed Blobaixxai-1.5.3.tgz
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectionaixxai-1.5.3.tgz
Affected versions and remediation
This report applies to aixxai@1.5.5.
See all versions of aixxai for other recorded verdicts.
- Review the evidence and your use of aixxai@1.5.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.