registry / apolo-zenith-code / 1.9.0

apolo-zenith-code@1.9.0

⚠ Under review

Apolo Zenith Code e a CLI de codificação agentica da Apolo Zenith 1.9, da Apolo.ai — interface Codex com os modelos da familia Apolo Zenith.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 8.82 KB of source, external domains: apolo-zenith-production.up.railway.app

Source & flagged code

3 flagged

bin/apolo-zenith-code.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// ✳ Apolo Zenith Code 1.9 — CLI de codificação agentica da Apolo.ai

3// Interface derivada da CLI Codex (wrapper unificado), apontada por padrão

4// para os modelos da família Apolo Zenith (nano, small, base, large, xlarge).

6import { spawn } from "node:child_process";

7import { existsSync, mkdirSync, writeFileSync, readFileSync } from "fs";

8import { homedir } from "node:os";

9import { createRequire } from "node:module";

10import path from "path";

11import { fileURLToPath } from "url";

13const AZUL = "\x1b[1;34m", DOURADO = "\x1b[0;33m", FIM = "\x1b[0m";

15// __dirname equivalente em ESM

16const __filename = fileURLToPath(import.meta.url);

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/apolo-zenith-code.jsView on unpkg · L5

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/apolo-zenith-code.jsView on unpkg · L5

17const __dirname = path.dirname(__filename);

18const require = createRequire(import.meta.url);

19const packageRoot = realpathSync(path.join(__dirname, ".."));

21function realpathSync(p) {

22 return require("fs").realpathSync(p);

23}

25// Pacotes de artefatos nativos (identificadores internos de compatibilidade

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. bin/apolo-zenith-code.js: import { existsSync, mkdirSync, writeFileSync, readFileSync } from "fs"; writeFileSync(cfgPath, cfg); writeFileSync(cfgPath, cfg); env.CODEX_HOME = APOLLO_HOME; const rlmod = await import("node:readline/promises"); writeFileSync(path.join(APOLLO_HOME, "token"), token); writeFileSync( writeFileSync(path.join(APOLLO_HOME, "email"), json.email || email);

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

bin/apolo-zenith-code.jsView on unpkg

Source & flagged code

3 flagged · loading source

bin/apolo-zenith-code.jsView file

5Source sends the broad process environment to a literal external destination. L5: L6: import { spawn } from "node:child_process"; L7: import { existsSync, mkdirSync, writeFileSync, readFileSync } from "fs"; ... L14: L15: // __dirname equivalente em ESM L16: const __filename = fileURLToPath(import.meta.url); ... L92: try { L93: const packageJsonPath = require.resolve(`${platformPackage}/package.json`); L94: vendorRoot = path.join(path.dirname(packageJsonPath), "vendor"); ... L102: "bin", L103: process.platform === "win32" ? "apolo-zenith-code.exe" : "apolo-zenith-code", L104: );

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/apolo-zenith-code.jsView on unpkg · L5

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

bin/apolo-zenith-code.jsView on unpkg

Findings

1 Critical2 High3 Medium2 Low

CriticalHardcoded Runtime Data Exfiltrationbin/apolo-zenith-code.js

HighCredential Redirect Persistencebin/apolo-zenith-code.js

HighSandbox Evasion Gated Capabilitybin/apolo-zenith-code.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowUrl Strings

Affected versions and remediation

This report applies to apolo-zenith-code@1.9.0.

See all versions of apolo-zenith-code for other recorded verdicts.

Review the evidence and your use of apolo-zenith-code@1.9.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 20:05:35.922Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.