claude-code-zanii@2.14.3
Missing restored features; use 2.14.4
Reverse-engineered Anthropic Claude Code CLI — interactive AI coding assistant in the terminal
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe package automatically discloses a persistent, host-derived identifier to its default ledger during ordinary CLI use without a first-run consent step. The opt-out and limited observed event payloads reduce the risk, so this supports a warning rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The CLI UI renders the proof component; setting ZANII_PROOF=0 disables the routine.
Impact
The service can associate the host-derived identifier with CLI sessions. The inspected flow records labels and hashes rather than raw memory content or credentials.
Mechanism
The routine hashes a system machine identifier, uses it in a remote account name, and posts that name to the default Zanii ledger. It then records and submits a session-start receipt.
AI rationale
The package automatically discloses a persistent, host-derived identifier to its default ledger during ordinary CLI use without a first-run consent step. The opt-out and limited observed event payloads reduce the risk, so this supports a warning rather than a publish block.
Evidence
dist/chunk-4fezhn5h.jsdist/chunk-g5d90kn3.jszanii-account.jsonzanii-agent.json
Network endpoints1
ledger.zanii.agency
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI renders a component that starts the proof routine automatically. It runs by default; setting ZANII_PROOF=0 disables it.
- The routine reads a system machine identifier, hashes it, and sends a fingerprint-based account name to the default Zanii ledger using a JSON POST.
- The default recipient is https://ledger.zanii.agency. The routine also records a session-start receipt and submits queued receipts to that service.
- Observed tool records contain tool labels, while memory-write records hash the content before recording it.
- The inspected plugin-install handler, cleanup initialization, and scheduler-lock code do not establish another attack path.
- The HTTPS proxy agent builds a CONNECT request to the requested host and port.
- The buffered writer sends content through its supplied write function immediately or buffers it for a scheduled flush.
- Claude-in-Chrome setup builds a named stdio MCP server configuration using the current process executable.
Evidence against
- The proof routine has an environment-variable opt-out, and the recorded memory content is represented by a hash rather than raw text.
Source & flagged code
22 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/chunk-hq40zj2w.jsView file
50// node_modules/@aws-sdk/credential-provider-process/dist-es/resolveProcessCredentials.js
L51: import { exec } from "child_process";
L52: import { promisify } from "util";
High
Child Process
Package source references child process execution.
Findings
4 Critical13 High7 Medium8 Low
CriticalCredential Exfiltrationdist/chunk-9sp9v9z3.js
CriticalBrowser Credential Phishingdist/chunk-mnrth8b3.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-9sp9v9z3.js
CriticalPrevious Version Dangerous Deltadist/chunk-9y87ptv0.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/chunk-hq40zj2w.js
HighShelldist/chunk-9sp9v9z3.js
HighEvaldist/chunk-9y87ptv0.js
HighCredential Redirect Persistencedist/chunk-xk2v555c.js
HighCommand Output Exfiltrationdist/chunk-mnrth8b3.js
HighSandbox Evasion Gated Capabilityscripts/postinstall.cjs
Affected versions and remediation
This report applies to claude-code-zanii@2.14.3.
See all versions of claude-code-zanii for other recorded verdicts.
- Review the evidence and your use of claude-code-zanii@2.14.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.