aixxai@1.5.7
AIXX CLI - 让你的AI调用万物。安装：npx aixxai install
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe explicit CLI command performs consequential agent configuration mutation, warranting a warning under the supplied policy. Package-aligned authentication and the absence of npm lifecycle hooks do not support a malware block.
Static reason
One or more suspicious static signals were detected.
Trigger
Running aixx install, optionally with --yes.
Impact
Subsequent Claude Code requests use the AIXX gateway, replacing a previously configured provider without separate confirmation.
Mechanism
The command adds ZCode providers and replaces Claude Code's provider URL and token with AIXX settings, backing up existing files first.
AI rationale
The explicit CLI command performs consequential agent configuration mutation, warranting a warning under the supplied policy. Package-aligned authentication and the absence of npm lifecycle hooks do not support a malware block.
Evidence
src/commands/install.jssrc/utils/agentconfig.jssrc/utils/env.js~/.claude/settings.json~/.zcode/v2/config.json~/.aixx/config.json~/.zshrc~/.bashrc~/.bash_profile
Network endpoints2
baodan.runbaodan.run/v1
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- package.json exposes a CLI with no npm install lifecycle hooks or runtime self-dependency.
- bin/aixx.js dispatches configuration through an explicit CLI command.
- src/commands/install.js calls configureAgents after obtaining an AIXX API key.
- src/utils/agentconfig.js overwrites Claude Code's provider URL and authentication token without separate confirmation, after backing up settings.
- src/utils/env.js persists AIXX credentials and its gateway URL in shell configuration; platform checks select the configuration method.
- src/commands/install.js sends the AIXX key to the package's gateway for a connectivity test.
Evidence against
- The gateway also registers AIXX accounts and creates their API keys; no unrelated credential harvesting was established.
- Agent configuration requires an explicit install command, and existing configuration files are backed up before modification.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
5 flaggedsrc/utils/env.jsView file
4* 把AIXX_API_KEY和AIXX_BASE_URL写入用户的shell配置
L5: * 支持 bash/zsh (Linux/macOS) 和 PowerShell (Windows)
L6: */
...
L13: // 会话16换门：统一走域名入口（HTTPS加密+CORS白名单+错key锁定+余额脱敏的网关），旧IP:8080仅存量兼容
L14: const DEFAULT_BASE_URL = 'https://baodan.run/v1';
L15:
...
L31: export function loadApiKey() {
L32: if (process.env.AIXX_API_KEY) return process.env.AIXX_API_KEY;
L33: const home = homedir();
L34: for (const file of [join(home, '.aixx', 'config.json'), join(home, '.aixx', 'account.json')]) {
...
L36: try {
L37: const conf = JSON.parse(readFileSync(file, 'utf-8'));
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
src/utils/env.jsView on unpkg · L44Trigger-reachable persistence chain: manifest.bin -> bin/aixx.js -> src/commands/balance.js -> src/utils/env.js
L4: * 把AIXX_API_KEY和AIXX_BASE_URL写入用户的shell配置
L5: * 支持 bash/zsh (Linux/macOS) 和 PowerShell (Windows)
L6: */
...
L13: // 会话16换门：统一走域名入口（HTTPS加密+CORS白名单+错key锁定+余额脱敏的网关），旧IP:8080仅存量兼容
L14: const DEFAULT_BASE_URL = 'https://baodan.run/v1';
L15:
...
L31: export function loadApiKey() {
L32: if (process.env.AIXX_API_KEY) return process.env.AIXX_API_KEY;
L33: const home = homedir();
L34: for (const file of [join(home, '.aixx', 'config.json'), join(home, '.aixx', 'account.json')]) {
...
L36: try {
L37: const conf = JSON.parse(readFileSync(file, 'utf-8'));
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
src/utils/env.jsFindings
3 High5 Medium4 Low
HighCredential Redirect Persistencesrc/commands/install.js
HighSandbox Evasion Gated Capabilitysrc/utils/env.js
HighTrigger Reachable Persistencesrc/utils/env.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/utils/env.js
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to aixxai@1.5.7.
See all versions of aixxai for other recorded verdicts.
- Review the evidence and your use of aixxai@1.5.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.