aixxai@1.6.6
AIXX CLI - 让你的AI调用万物。安装：npx aixxai
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe reviewed source does not establish credential theft or an npm install-time attack. The automatic agent configuration can replace an existing Claude Code provider during an explicit CLI install, so this warrants a warning.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the install command, or the CLI’s default install flow, with an AIXX API key available.
Impact
Future Claude Code API traffic may be routed through the AIXX gateway, and an existing provider configuration may be replaced.
Mechanism
The installer calls the agent configurator, which writes the AIXX endpoint and key to Claude Code settings without asking before the write.
AI rationale
The reviewed source does not establish credential theft or an npm install-time attack. The automatic agent configuration can replace an existing Claude Code provider during an explicit CLI install, so this warrants a warning.
Evidence
src/commands/install.jssrc/utils/agentconfig.js~/.claude/settings.json~/.zcode/v2/config.json
Network endpoints1
console.aixx.ai
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes a CLI but declares no npm install lifecycle hook; the install behavior is reached through its install command.
- After an API key is available, the install command automatically calls the agent configurator, which writes the AIXX endpoint and key into an existing Claude Code settings file.
- When Claude Code already has a different provider endpoint, the configurator replaces its endpoint and token; the overwrite notice appears after the write.
- The installer’s registration and related account operations use the package’s default AIXX service host, rather than an unrelated credential recipient.
Evidence against
- The configuration change is part of the user-invoked CLI install flow, and the gateway matches the package’s AIXX service.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedsrc/utils/env.jsView file
4* 把AIXX_API_KEY和AIXX_BASE_URL写入用户的shell配置
L5: * 支持 bash/zsh (Linux/macOS) 和 PowerShell (Windows)
L6: */
...
L14: // 卡170(1011)换门二: baodan.run网关的/api/*全归爆单后端(CLI注册/login/token 404断链39天)——账号管理与模型调用统一走萬安云自有域名
L15: const DEFAULT_BASE_URL = 'https://console.aixx.ai/v1';
L16:
...
L32: export function loadApiKey() {
L33: if (process.env.AIXX_API_KEY) return process.env.AIXX_API_KEY;
L34: const home = homedir();
L35: for (const file of [join(home, '.aixx', 'config.json'), join(home, '.aixx', 'account.json')]) {
...
L37: try {
L38: const conf = JSON.parse(readFileSync(file, 'utf-8'));
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
src/utils/env.jsView on unpkg · L44Trigger-reachable persistence chain: manifest.bin -> bin/aixx.js -> src/commands/balance.js -> src/utils/env.js
L4: * 把AIXX_API_KEY和AIXX_BASE_URL写入用户的shell配置
L5: * 支持 bash/zsh (Linux/macOS) 和 PowerShell (Windows)
L6: */
...
L14: // 卡170(1011)换门二: baodan.run网关的/api/*全归爆单后端(CLI注册/login/token 404断链39天)——账号管理与模型调用统一走萬安云自有域名
L15: const DEFAULT_BASE_URL = 'https://console.aixx.ai/v1';
L16:
...
L32: export function loadApiKey() {
L33: if (process.env.AIXX_API_KEY) return process.env.AIXX_API_KEY;
L34: const home = homedir();
L35: for (const file of [join(home, '.aixx', 'config.json'), join(home, '.aixx', 'account.json')]) {
...
L37: try {
L38: const conf = JSON.parse(readFileSync(file, 'utf-8'));
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
Findings
4 High4 Medium4 Low
HighHost Fingerprint Exfiltrationsrc/commands/install.js
HighCredential Redirect Persistencesrc/commands/install.js
HighSandbox Evasion Gated Capabilitysrc/utils/env.js
HighTrigger Reachable Persistencesrc/utils/env.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/utils/env.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to aixxai@1.6.6.
See all versions of aixxai for other recorded verdicts.
- Review the evidence and your use of aixxai@1.6.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.