aixxai@1.6.1
AIXX CLI - 让你的AI调用万物。安装：npx aixxai
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe package has no npm install lifecycle hook, but its CLI installer automatically writes the AIXX key and gateway into detected agent settings and shell configuration. This user-command agent configuration behavior warrants a warning; the inspected source does not establish credential theft or a malicious attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the `aixx` install command with an API key available.
Impact
Agent requests configured to use AIXX can send the stored key to `console.aixx.ai`; shell and local settings retain the key.
Mechanism
The installer invokes agent configuration, writes the key and fixed AIXX gateway into Claude Code settings when present, and saves AIXX environment values locally and in shell startup settings.
AI rationale
The package has no npm install lifecycle hook, but its CLI installer automatically writes the AIXX key and gateway into detected agent settings and shell configuration. This user-command agent configuration behavior warrants a warning; the inspected source does not establish credential theft or a malicious attack.
Evidence
~/.claude/settings.json~/.aixx/config.json~/.zshrc~/.bashrc~/.bash_profile
Network endpoints1
console.aixx.ai
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes an `aixx` CLI and defines no npm install lifecycle hook.
- The CLI install flow calls agent configuration after obtaining an API key.
- When a Claude Code settings file exists, configuration writes the AIXX gateway URL and API key into its environment settings.
- The gateway host is fixed to `console.aixx.ai`.
- The installer saves the API key in local AIXX settings and appends AIXX variables to shell startup settings.
Evidence against
- This configuration behavior is activated through the CLI install command; the manifest has no preinstall, install, or postinstall hook.
- The configured agent credential is directed to the package's fixed AIXX gateway, with no inspected send to an unrelated endpoint.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedsrc/utils/env.jsView file
4* 把AIXX_API_KEY和AIXX_BASE_URL写入用户的shell配置
L5: * 支持 bash/zsh (Linux/macOS) 和 PowerShell (Windows)
L6: */
...
L14: // 卡170(1011)换门二: baodan.run网关的/api/*全归爆单后端(CLI注册/login/token 404断链39天)——账号管理与模型调用统一走萬安云自有域名
L15: const DEFAULT_BASE_URL = 'https://console.aixx.ai/v1';
L16:
...
L32: export function loadApiKey() {
L33: if (process.env.AIXX_API_KEY) return process.env.AIXX_API_KEY;
L34: const home = homedir();
L35: for (const file of [join(home, '.aixx', 'config.json'), join(home, '.aixx', 'account.json')]) {
...
L37: try {
L38: const conf = JSON.parse(readFileSync(file, 'utf-8'));
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
src/utils/env.jsView on unpkg · L44Trigger-reachable persistence chain: manifest.bin -> bin/aixx.js -> src/commands/balance.js -> src/utils/env.js
L4: * 把AIXX_API_KEY和AIXX_BASE_URL写入用户的shell配置
L5: * 支持 bash/zsh (Linux/macOS) 和 PowerShell (Windows)
L6: */
...
L14: // 卡170(1011)换门二: baodan.run网关的/api/*全归爆单后端(CLI注册/login/token 404断链39天)——账号管理与模型调用统一走萬安云自有域名
L15: const DEFAULT_BASE_URL = 'https://console.aixx.ai/v1';
L16:
...
L32: export function loadApiKey() {
L33: if (process.env.AIXX_API_KEY) return process.env.AIXX_API_KEY;
L34: const home = homedir();
L35: for (const file of [join(home, '.aixx', 'config.json'), join(home, '.aixx', 'account.json')]) {
...
L37: try {
L38: const conf = JSON.parse(readFileSync(file, 'utf-8'));
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
Findings
3 High5 Medium4 Low
HighCredential Redirect Persistencesrc/commands/install.js
HighSandbox Evasion Gated Capabilitysrc/utils/env.js
HighTrigger Reachable Persistencesrc/utils/env.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/utils/env.js
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to aixxai@1.6.1.
See all versions of aixxai for other recorded verdicts.
- Review the evidence and your use of aixxai@1.6.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.