aixxai@1.5.9
AIXX CLI - 让你的AI调用万物。安装：npx aixxai
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe package has an explicit install command that automatically configures detected agents and stores the service key, a concrete agent capability warranting a warning. The inspected source does not establish covert exfiltration or malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the `aixx install` command and the flow obtains an API key.
Impact
The configured agents use the AIXX service with that key; no unrelated credential recipient or install-time hook was established.
Mechanism
The installer writes the AIXX gateway URL and API key into detected agent configuration, and stores the key in local AIXX configuration.
AI rationale
The package has an explicit install command that automatically configures detected agents and stores the service key, a concrete agent capability warranting a warning. The inspected source does not establish covert exfiltration or malicious behavior.
Evidence
src/commands/install.jssrc/utils/agentconfig.jssrc/utils/env.js
Network endpoints1
baodan.run
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes an `aixx` CLI and defines no install lifecycle hook.
- The install command can prompt before registering an account; `--yes` skips that prompt.
- After installation, the command automatically calls agent configuration setup with the API key.
- Agent setup writes the key and the AIXX gateway URL into Claude Code settings.
- The install flow sends registration data to the AIXX service and saves the resulting key for its CLI configuration.
Evidence against
- The agent configuration changes follow an explicit CLI install command; the inspected source shows no separate install-hook execution.
- The configured gateway is the package's stated AIXX service, and the inspected registration flow does not show credentials sent to an unrelated recipient.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
5 flaggedsrc/utils/env.jsView file
4* 把AIXX_API_KEY和AIXX_BASE_URL写入用户的shell配置
L5: * 支持 bash/zsh (Linux/macOS) 和 PowerShell (Windows)
L6: */
...
L13: // 会话16换门：统一走域名入口（HTTPS加密+CORS白名单+错key锁定+余额脱敏的网关），旧IP:8080仅存量兼容
L14: const DEFAULT_BASE_URL = 'https://baodan.run/v1';
L15:
...
L31: export function loadApiKey() {
L32: if (process.env.AIXX_API_KEY) return process.env.AIXX_API_KEY;
L33: const home = homedir();
L34: for (const file of [join(home, '.aixx', 'config.json'), join(home, '.aixx', 'account.json')]) {
...
L36: try {
L37: const conf = JSON.parse(readFileSync(file, 'utf-8'));
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
src/utils/env.jsView on unpkg · L44Trigger-reachable persistence chain: manifest.bin -> bin/aixx.js -> src/commands/balance.js -> src/utils/env.js
L4: * 把AIXX_API_KEY和AIXX_BASE_URL写入用户的shell配置
L5: * 支持 bash/zsh (Linux/macOS) 和 PowerShell (Windows)
L6: */
...
L13: // 会话16换门：统一走域名入口（HTTPS加密+CORS白名单+错key锁定+余额脱敏的网关），旧IP:8080仅存量兼容
L14: const DEFAULT_BASE_URL = 'https://baodan.run/v1';
L15:
...
L31: export function loadApiKey() {
L32: if (process.env.AIXX_API_KEY) return process.env.AIXX_API_KEY;
L33: const home = homedir();
L34: for (const file of [join(home, '.aixx', 'config.json'), join(home, '.aixx', 'account.json')]) {
...
L36: try {
L37: const conf = JSON.parse(readFileSync(file, 'utf-8'));
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
src/utils/env.jsFindings
3 High5 Medium4 Low
HighCredential Redirect Persistencesrc/commands/install.js
HighSandbox Evasion Gated Capabilitysrc/utils/env.js
HighTrigger Reachable Persistencesrc/utils/env.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/utils/env.js
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to aixxai@1.5.9.
See all versions of aixxai for other recorded verdicts.
- Review the evidence and your use of aixxai@1.5.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.