apiblaze@0.21.19
APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source establishes explicit agent configuration behavior but no automatic package-install mutation or concrete malicious payload. Treat this as a guarded AI-agent capability risk.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user invokes apichat with --install-mcp codex or accepts the interactive offer.
Impact
This grants a configured APIblaze MCP endpoint to Codex; it is an explicit agent-configuration capability rather than an install-time action.
Mechanism
The CLI writes an APIblaze MCP server block into the Codex configuration file.
AI rationale
The source establishes explicit agent configuration behavior but no automatic package-install mutation or concrete malicious payload. Treat this as a guarded AI-agent capability risk.
Evidence
.codex/config.toml
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package metadata exposes a CLI and has only a prepublish build hook, not an install lifecycle hook.
- The apichat command offers an explicit --install-mcp option to connect a proxy to Codex or Claude.
- The Codex setup function rewrites an MCP server block in the user's Codex configuration.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
8 flaggeddist/index.jsView file
78const raw = fs2.readFileSync(CREDENTIALS_PATH, "utf-8");
L79: return JSON.parse(raw);
L80: } catch {
...
L84: function getAccessToken() {
L85: const fromEnv = process.env.APIBLAZE_TOKEN;
L86: if (fromEnv && fromEnv.trim()) return fromEnv.trim();
...
L105: path2 = __toESM(require("path"));
L106: APIBLAZE_DIR = path2.join(os2.homedir(), ".apiblaze");
L107: CREDENTIALS_PATH = path2.join(APIBLAZE_DIR, "credentials.json");
...
L124: agentCall: () => agentCall,
L125: bothDoorsBody: () => bothDoorsBody,
L126: checkProxyName: () => checkProxyName,
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L7878Trigger-reachable chain: manifest.main -> dist/index.js
L78: const raw = fs2.readFileSync(CREDENTIALS_PATH, "utf-8");
L79: return JSON.parse(raw);
L80: } catch {
...
L84: function getAccessToken() {
L85: const fromEnv = process.env.APIBLAZE_TOKEN;
L86: if (fromEnv && fromEnv.trim()) return fromEnv.trim();
...
L105: path2 = __toESM(require("path"));
L106: APIBLAZE_DIR = path2.join(os2.homedir(), ".apiblaze");
L107: CREDENTIALS_PATH = path2.join(APIBLAZE_DIR, "credentials.json");
...
L124: agentCall: () => agentCall,
L125: bothDoorsBody: () => bothDoorsBody,
L126: checkProxyName: () => checkProxyName,
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L78Findings
3 Critical6 High3 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to apiblaze@0.21.19.
See all versions of apiblaze for other recorded verdicts.
- Review the evidence and your use of apiblaze@0.21.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.