claude-code-zanii@2.14.1
Reverse-engineered Anthropic Claude Code CLI — interactive AI coding assistant in the terminal
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete conditional credential-forwarding capability to an unrestricted endpoint, but it is user-invoked and not an automatic install-time attack. The source does not establish covert default exfiltration or a blocking malware chain.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user invokes the CLI ssh command while an Anthropic credential and a custom ANTHROPIC_BASE_URL are available.
Impact
A configured unrelated endpoint could receive the local API key or OAuth token.
Mechanism
Credential-bearing proxy requests to an unrestricted environment-selected URL.
AI rationale
This is a concrete conditional credential-forwarding capability to an unrestricted endpoint, but it is user-invoked and not an automatic install-time attack. The source does not establish covert default exfiltration or a blocking malware chain.
Evidence
dist/chunk-2v82wpr3.jsdist/chunk-5yvcpzez.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The reachable ssh feature obtains the existing Anthropic API key or stored OAuth access token.
- Its proxy takes ANTHROPIC_BASE_URL directly from the environment without destination validation.
- The proxy attaches that credential to requests sent to the selected upstream URL.
- The CLI imports and runs this SSH session feature after the user invokes the ssh command.
Evidence against
- The manifest has no preinstall, install, or postinstall lifecycle hook.
- The observed credential forwarding is tied to an explicit SSH command, not package installation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsPossibleObfuscationTelemetryUrlStrings
Source & flagged code
19 flaggeddist/chunk-5ytsdgrp.jsView file
33(function(AzureAuthorityHosts2) {
L34: AzureAuthorityHosts2["AzureChina"] = "https://login.chinacloudapi.cn";
L35: AzureAuthorityHosts2["AzureGermany"] = "https://login.microsoftonline.de";
...
L199: try {
L200: const oauthErrorResponse = JSON.parse(errorBody);
L201: errorResponse = [redacted](oauthErrorResponse);
...
L212: error: "unknown_error",
L213: errorDescription: `An unknown error has occurred. Response body:
L214:
...
L260: function log(message, ...args) {
L261: process2.stderr.write(`${util.format(message, ...args)}${EOL}`);
L262: }
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/chunk-5ytsdgrp.jsView on unpkg · L3333(function(AzureAuthorityHosts2) {
L34: AzureAuthorityHosts2["AzureChina"] = "https://login.chinacloudapi.cn";
L35: AzureAuthorityHosts2["AzureGermany"] = "https://login.microsoftonline.de";
...
L199: try {
L200: const oauthErrorResponse = JSON.parse(errorBody);
L201: errorResponse = [redacted](oauthErrorResponse);
...
L212: error: "unknown_error",
L213: errorDescription: `An unknown error has occurred. Response body:
L214:
...
L260: function log(message, ...args) {
L261: process2.stderr.write(`${util.format(message, ...args)}${EOL}`);
L262: }
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/chunk-5ytsdgrp.jsView on unpkg · L33Findings
4 Critical10 High7 Medium9 Low
CriticalCredential Exfiltrationdist/chunk-2pc9jd1j.js
CriticalBrowser Credential Phishingdist/chunk-5ytsdgrp.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-2pc9jd1j.js
CriticalPrevious Version Dangerous Deltadist/chunk-5yvcpzez.js
HighChild Processdist/chunk-c17f0h2s.js
HighShelldist/chunk-pfxrg89f.js
HighCredential Redirect Persistencedist/chunk-5yvcpzez.js
HighCommand Output Exfiltrationdist/chunk-5ytsdgrp.js
HighSandbox Evasion Gated Capabilityscripts/postinstall.cjs
HighCloud Metadata Accessdist/chunk-5ytsdgrp.js
HighInstall Named Payload Filescripts/postinstall.cjs
Affected versions and remediation
This report applies to claude-code-zanii@2.14.1.
See all versions of claude-code-zanii for other recorded verdicts.
- Review the evidence and your use of claude-code-zanii@2.14.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.