apiblaze@0.21.26
APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected source supports a warning for explicit-command agent configuration mutation with persistent effects and later automatic refresh. The scanner's malicious label is not supported by a concrete covert attack chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running agent connection commands or accepting the interactive MCP setup offer; later CLI runs refresh accepted installations.
Impact
Future agent sessions can access the connected API and follow persistent project instructions.
Mechanism
Writes MCP configuration, saves installation preferences, refreshes accepted entries, and adds instructions directing agents to use API tools.
AI rationale
Inspected source supports a warning for explicit-command agent configuration mutation with persistent effects and later automatic refresh. The scanner's malicious label is not supported by a concrete covert attack chain.
Evidence
dist/index.js.codex/config.tomlAGENTS.mdCLAUDE.md
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest has a publisher build hook but no automatic npm install lifecycle hook.
- The CLI persists MCP entries in the user's Codex configuration.
- Agent setup asks the user to connect a proxy, or accepts an explicit installation option.
- Previously accepted MCP installations are automatically refreshed during later CLI runs.
- Setup also adds standing instructions to AGENTS.md or CLAUDE.md.
- The LLM credential is explicitly entered by the user and included in chat requests.
Evidence against
- No concrete covert credential harvesting or malicious install chain was established.
- Existing unrelated MCP entries receive conflict protection rather than unconditional replacement.
- The server client uses caller-supplied credentials for API operations.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
8 flaggeddist/index.jsView file
32L33: // package.json
L34: var version;
...
L70: function cacheFile() {
L71: return import_path.default.join(import_os.default.homedir(), ".apiblaze", "cli-policy.json");
L72: }
...
L81: for (const name of CONTROL_PLANE_ENV) {
L82: const v = process.env[name];
L83: try {
...
L120: const base2 = globalThis.fetch.bind(globalThis);
L121: globalThis.fetch = (async (input, init) => {
L122: const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L3232Trigger-reachable chain: manifest.main -> dist/index.js
L32:
L33: // package.json
L34: var version;
...
L70: function cacheFile() {
L71: return import_path.default.join(import_os.default.homedir(), ".apiblaze", "cli-policy.json");
L72: }
...
L81: for (const name of CONTROL_PLANE_ENV) {
L82: const v = process.env[name];
L83: try {
...
L120: const base2 = globalThis.fetch.bind(globalThis);
L121: globalThis.fetch = (async (input, init) => {
L122: const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L32Findings
2 Critical7 High3 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighCross File Remote Execution Contextdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to apiblaze@0.21.26.
See all versions of apiblaze for other recorded verdicts.
- Review the evidence and your use of apiblaze@0.21.26 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.