apolo-zenith-code@1.9.2: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

apolo-zenith-code@1.9.2: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged · loading source

bin/apolo-zenith-code.jsView file

5Source sends the broad process environment to a literal external destination. L5: L6: import { spawn } from "node:child_process"; L7: import { existsSync, mkdirSync, writeFileSync, readFileSync } from "fs"; ... L14: L15: // __dirname equivalente em ESM L16: const __filename = fileURLToPath(import.meta.url); ... L92: try { L93: const packageJsonPath = require.resolve(`${platformPackage}/package.json`); L94: vendorRoot = path.join(path.dirname(packageJsonPath), "vendor"); ... L102: "bin", L103: process.platform === "win32" ? "apolo-zenith-code.exe" : "apolo-zenith-code", L104: );

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/apolo-zenith-code.jsView on unpkg · L5

5L6: import { spawn } from "node:child_process"; L7: import { existsSync, mkdirSync, writeFileSync, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

bin/apolo-zenith-code.jsView on unpkg · L5

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. bin/apolo-zenith-code.js: import { existsSync, mkdirSync, writeFileSync, readFileSync } from "fs"; writeFileSync(cfgPath, cfg); writeFileSync(cfgPath, cfg); env.CODEX_HOME = APOLLO_HOME; const rlmod = await import("node:readline/promises"); writeFileSync(path.join(APOLLO_HOME, "token"), token); writeFileSync( writeFileSync(path.join(APOLLO_HOME, "email"), json.email || email);

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

bin/apolo-zenith-code.jsView on unpkg

5L6: import { spawn } from "node:child_process"; L7: import { existsSync, mkdirSync, writeFileSync, readFileSync } from "fs"; ... L14: L15: // __dirname equivalente em ESM L16: const __filename = fileURLToPath(import.meta.url); ... L92: try { L93: const packageJsonPath = require.resolve(`${platformPackage}/package.json`); L94: vendorRoot = path.join(path.dirname(packageJsonPath), "vendor"); ... L102: "bin", L103: process.platform === "win32" ? "apolo-zenith-code.exe" : "apolo-zenith-code", L104: );

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/apolo-zenith-code.jsView on unpkg · L5

298); L299: var child = spawn("npx", ["-y", "@openai/codex@latest", ...process.argv.slice(2)], { L300: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/apolo-zenith-code.jsView on unpkg · L298

129const APOLLO_HOME = path.join(homedir(), ".apolo-zenith-code"); const API_BASE = process.env.APOLO_API_URL || "https://apolo-zenith-production.up.railway.app";

High

Suspicious Dependency Evidence

The default API endpoint is a fixed Railway host controlled outside the declared OpenAI dependency chain.

bin/apolo-zenith-code.jsView on unpkg · L129

Source & flagged code

6 flagged

bin/apolo-zenith-code.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// ✳ Apolo Zenith Code 1.9 — CLI de codificação agentica da Apolo.ai

3// Interface derivada da CLI Codex (wrapper unificado), apontada por padrão

4// para os modelos da família Apolo Zenith (nano, small, base, large, xlarge).

5

6import { spawn } from "node:child_process";

7import { existsSync, mkdirSync, writeFileSync, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

bin/apolo-zenith-code.jsView on unpkg · L5

8import { homedir } from "node:os";

9import { createRequire } from "node:module";

10import path from "path";

11import { fileURLToPath } from "url";

12

13const AZUL = "\x1b[1;34m", DOURADO = "\x1b[0;33m", FIM = "\x1b[0m";

14

15// __dirname equivalente em ESM

16const __filename = fileURLToPath(import.meta.url);

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/apolo-zenith-code.jsView on unpkg · L5

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/apolo-zenith-code.jsView on unpkg · L5

17const __dirname = path.dirname(__filename);

18const require = createRequire(import.meta.url);

19const packageRoot = realpathSync(path.join(__dirname, ".."));

20

21function realpathSync(p) {

22 return require("fs").realpathSync(p);

23}

24

25// Pacotes de artefatos nativos (identificadores internos de compatibilidade

Lines 109-149javascript

109 // fallback: binário upstream com nome original

110 const fallback = path.join(

111 vendorRoot,

112 targetTriple,

113 "bin",

114 process.platform === "win32" ? "codex.exe"

Lines 278-318javascript

278}

279

280// spawn assíncrono para repassar sinais (Ctrl-C) ao binário nativo.

281const envApolo = prepararApolo();

282let binaryPath;

283try {

284 binaryPath = resolverBinario();

285} catch

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. bin/apolo-zenith-code.js: import { existsSync, mkdirSync, writeFileSync, readFileSync } from "fs"; writeFileSync(cfgPath, cfg); writeFileSync(cfgPath, cfg); env.CODEX_HOME = APOLLO_HOME; const rlmod = await import("node:readline/promises"); writeFileSync(path.join(APOLLO_HOME, "token"), token); writeFileSync( writeFileSync(path.join(APOLLO_HOME, "email"), json.email || email);

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

bin/apolo-zenith-code.jsView on unpkg