apiblaze@0.21.37
APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe manifest has no install-time execution hook, and the inspected agent setup is user-selected. The LLM key is stored locally and forwarded in the package's chat flow; the inspected source does not establish an unrelated recipient or concrete attack behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
An explicit user command to chat or configure an external MCP client.
Impact
These inspected behaviors do not establish credential theft or unconsented agent control-surface mutation.
Mechanism
The CLI can send a configured LLM key with a chat request to its APIblaze flow and can add an MCP entry to the local Codex config after the user selects setup.
AI rationale
The manifest has no install-time execution hook, and the inspected agent setup is user-selected. The LLM key is stored locally and forwarded in the package's chat flow; the inspected source does not establish an unrelated recipient or concrete attack behavior.
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has only a prepublish-only build and type-check hook, with no install-time hook.
- The indicated Codex path is used to locate the local config.toml file; the source does not establish an automatic write from that location alone.
- Agent MCP setup is offered through an interactive choice, and the user can choose to chat directly instead.
- A saved LLM key is added to the chat request only when configured, for the package's APIblaze chat flow.
- The package stores the LLM key locally with restrictive file permissions.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
9 flaggeddist/index.jsView file
32L33: // package.json
L34: var version;
...
L93: function cacheFile() {
L94: return import_path.default.join(import_os.default.homedir(), ".apiblaze", "cli-policy.json");
L95: }
...
L104: for (const name of CONTROL_PLANE_ENV) {
L105: const v = process.env[name];
L106: try {
...
L143: const base2 = globalThis.fetch.bind(globalThis);
L144: globalThis.fetch = (async (input, init) => {
L145: const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L3232Trigger-reachable chain: manifest.main -> dist/index.js
L32:
L33: // package.json
L34: var version;
...
L93: function cacheFile() {
L94: return import_path.default.join(import_os.default.homedir(), ".apiblaze", "cli-policy.json");
L95: }
...
L104: for (const name of CONTROL_PLANE_ENV) {
L105: const v = process.env[name];
L106: try {
...
L143: const base2 = globalThis.fetch.bind(globalThis);
L144: globalThis.fetch = (async (input, init) => {
L145: const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L32Findings
3 Critical7 High3 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighCross File Remote Execution Contextdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to apiblaze@0.21.37.
See all versions of apiblaze for other recorded verdicts.
- Review the evidence and your use of apiblaze@0.21.37 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.