aixxai@1.6.4
AIXX CLI - 让你的AI调用万物。安装：npx aixxai
AI Security Review
scanned 23d ago · by lpm-firewall-aiThe source confirms an explicit install command can overwrite existing Claude Code provider settings without asking first. This is a package-owned agent setup capability; the manifest has no npm lifecycle hook, and the configured endpoint is the package’s AIXX gateway.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the install command, or invokes the CLI bare, with an API key available and an existing Claude Code settings file.
Impact
Claude Code requests may be routed through the AIXX gateway using the configured AIXX key. The change can replace a previously configured provider.
Mechanism
The installer calls agent configuration code that replaces ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN with AIXX values; it backs up the settings file but does not ask before writing.
AI rationale
The source confirms an explicit install command can overwrite existing Claude Code provider settings without asking first. This is a package-owned agent setup capability; the manifest has no npm lifecycle hook, and the configured endpoint is the package’s AIXX gateway.
Evidence
bin/aixx.jssrc/commands/install.jssrc/utils/agentconfig.js~/.claude/settings.json~/.zcode/v2/config.json
Network endpoints1
console.aixx.ai/v1
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes a CLI and a test script only; the bare CLI route invokes the install command.
- The installer checks for a local Claude skills directory and calls configureAgents after obtaining an API key.
- For an existing Claude Code settings file, the installer replaces its Anthropic endpoint and token with AIXX values and writes the file without a pre-write consent prompt.
- The Claude settings file is backed up before the change, and the replacement is directed to the package’s AIXX gateway.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedsrc/utils/env.jsView file
4* 把AIXX_API_KEY和AIXX_BASE_URL写入用户的shell配置
L5: * 支持 bash/zsh (Linux/macOS) 和 PowerShell (Windows)
L6: */
...
L14: // 卡170(1011)换门二: baodan.run网关的/api/*全归爆单后端(CLI注册/login/token 404断链39天)——账号管理与模型调用统一走萬安云自有域名
L15: const DEFAULT_BASE_URL = 'https://console.aixx.ai/v1';
L16:
...
L32: export function loadApiKey() {
L33: if (process.env.AIXX_API_KEY) return process.env.AIXX_API_KEY;
L34: const home = homedir();
L35: for (const file of [join(home, '.aixx', 'config.json'), join(home, '.aixx', 'account.json')]) {
...
L37: try {
L38: const conf = JSON.parse(readFileSync(file, 'utf-8'));
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
src/utils/env.jsView on unpkg · L44Trigger-reachable persistence chain: manifest.bin -> bin/aixx.js -> src/commands/balance.js -> src/utils/env.js
L4: * 把AIXX_API_KEY和AIXX_BASE_URL写入用户的shell配置
L5: * 支持 bash/zsh (Linux/macOS) 和 PowerShell (Windows)
L6: */
...
L14: // 卡170(1011)换门二: baodan.run网关的/api/*全归爆单后端(CLI注册/login/token 404断链39天)——账号管理与模型调用统一走萬安云自有域名
L15: const DEFAULT_BASE_URL = 'https://console.aixx.ai/v1';
L16:
...
L32: export function loadApiKey() {
L33: if (process.env.AIXX_API_KEY) return process.env.AIXX_API_KEY;
L34: const home = homedir();
L35: for (const file of [join(home, '.aixx', 'config.json'), join(home, '.aixx', 'account.json')]) {
...
L37: try {
L38: const conf = JSON.parse(readFileSync(file, 'utf-8'));
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
Findings
3 High5 Medium4 Low
HighCredential Redirect Persistencesrc/commands/install.js
HighSandbox Evasion Gated Capabilitysrc/utils/env.js
HighTrigger Reachable Persistencesrc/utils/env.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/utils/env.js
MediumStructural Risk Force Deep Review
MediumAi Review Evidencepackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to aixxai@1.6.4.
See all versions of aixxai for other recorded verdicts.
- Review the evidence and your use of aixxai@1.6.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.