aixxai@1.6.0
AIXX CLI - 让你的AI调用万物。安装：npx aixxai
AI Security Review
scanned 25d ago · by lpm-firewall-aiSource inspection found automatic first-party agent configuration during the explicit install command, including key storage and possible replacement of an existing Claude provider URL. This supports a warning for agent extension lifecycle risk, while the inspected code does not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes the `aixx install` command with an API key available.
Impact
The agent’s provider routing and saved credentials may change; inspected source does not establish credential theft or a concrete attack.
Mechanism
The installer calls agent configuration, which writes the AIXX endpoint and key into detected Claude Code settings.
AI rationale
Source inspection found automatic first-party agent configuration during the explicit install command, including key storage and possible replacement of an existing Claude provider URL. This supports a warning for agent extension lifecycle risk, while the inspected code does not establish malicious behavior.
Evidence
src/commands/install.jssrc/utils/agentconfig.jssrc/utils/env.js
Network endpoints1
console.aixx.ai
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes an `aixx` CLI and provides an explicit install command.
- The install command passes the selected API key to automatic agent configuration.
- That setup writes the key and AIXX service URL into detected Claude Code settings, replacing an existing provider URL when present.
- The configured endpoint is the package’s AIXX service, and the source does not establish credential theft or another concrete attack.
Evidence against
- The agent configuration changes occur without a separate per-agent confirmation and may replace an existing provider setting.
- The installer also stores the key in local configuration and shell settings.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedsrc/utils/env.jsView file
4* 把AIXX_API_KEY和AIXX_BASE_URL写入用户的shell配置
L5: * 支持 bash/zsh (Linux/macOS) 和 PowerShell (Windows)
L6: */
...
L14: // 卡170(1011)换门二: baodan.run网关的/api/*全归爆单后端(CLI注册/login/token 404断链39天)——账号管理与模型调用统一走萬安云自有域名
L15: const DEFAULT_BASE_URL = 'https://console.aixx.ai/v1';
L16:
...
L32: export function loadApiKey() {
L33: if (process.env.AIXX_API_KEY) return process.env.AIXX_API_KEY;
L34: const home = homedir();
L35: for (const file of [join(home, '.aixx', 'config.json'), join(home, '.aixx', 'account.json')]) {
...
L37: try {
L38: const conf = JSON.parse(readFileSync(file, 'utf-8'));
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
src/utils/env.jsView on unpkg · L44Trigger-reachable persistence chain: manifest.bin -> bin/aixx.js -> src/commands/balance.js -> src/utils/env.js
L4: * 把AIXX_API_KEY和AIXX_BASE_URL写入用户的shell配置
L5: * 支持 bash/zsh (Linux/macOS) 和 PowerShell (Windows)
L6: */
...
L14: // 卡170(1011)换门二: baodan.run网关的/api/*全归爆单后端(CLI注册/login/token 404断链39天)——账号管理与模型调用统一走萬安云自有域名
L15: const DEFAULT_BASE_URL = 'https://console.aixx.ai/v1';
L16:
...
L32: export function loadApiKey() {
L33: if (process.env.AIXX_API_KEY) return process.env.AIXX_API_KEY;
L34: const home = homedir();
L35: for (const file of [join(home, '.aixx', 'config.json'), join(home, '.aixx', 'account.json')]) {
...
L37: try {
L38: const conf = JSON.parse(readFileSync(file, 'utf-8'));
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
Findings
4 High5 Medium5 Low
HighCredential Redirect Persistencesrc/commands/install.js
HighSandbox Evasion Gated Capabilitysrc/utils/env.js
HighTrigger Reachable Persistencesrc/utils/env.js
HighShips High Entropy Blobaixxai-1.6.0.tgz
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/utils/env.js
MediumShips Compressed Blobaixxai-1.6.0.tgz
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectionaixxai-1.6.0.tgz
Affected versions and remediation
This report applies to aixxai@1.6.0.
See all versions of aixxai for other recorded verdicts.
- Review the evidence and your use of aixxai@1.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.