claude-code-zanii@2.14.4
Reverse-engineered Anthropic Claude Code CLI — interactive AI coding assistant in the terminal
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe CLI includes an auto-enabled Zanii integration that fingerprints the machine, creates a Zanii account, and reports sessions and tool names to a fixed ledger host. The reviewed flow does not send provider credentials or raw tool output, so this is suspicious identifying runtime telemetry rather than proven credential theft.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The CLI calls the startup proof when its ZaniiLine UI component is rendered; tool events are recorded as tools run.
Impact
The service can associate CLI sessions and tool usage with a persistent host and account. No raw credentials or tool output were identified in this flow.
Mechanism
Unless ZANII_PROOF=0, the package hashes machine identifiers, automatically registers an account, and records session and tool events to ledger.zanii.agency.
AI rationale
The CLI includes an auto-enabled Zanii integration that fingerprints the machine, creates a Zanii account, and reports sessions and tool names to a fixed ledger host. The reviewed flow does not send provider credentials or raw tool output, so this is suspicious identifying runtime telemetry rather than proven credential theft.
Evidence
dist/chunk-wsphevzj.jsdist/chunk-83cb60gz.jsdist/chunk-kak5hn5f.js<config directory>/zanii-agent.json<config directory>/zanii-account.json
Network endpoints1
ledger.zanii.agency
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The Zanii integration is enabled unless the user sets ZANII_PROOF=0; the bundle returns true by default.
- It derives a stable hash from machine identifiers, including hardware UUIDs and machine IDs.
- The CLI’s ZaniiLine component calls the startup proof flow when rendered, which records a session start.
- The integration registers an account with the Zanii ledger and saves its returned account and API keys in the config directory.
- Successful and failed tool executions record the tool name and status to the Zanii ledger.
Evidence against
- The reviewed Zanii flow records tool names and success/error status, not tool inputs or outputs.
- No provider credential values were found being sent in the reviewed Zanii flow.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
Source & flagged code
22 flaggeddist/chunk-rhj0dnby.jsView file
10126patternName = generic_password
severity = medium
line = 10126
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/chunk-rhj0dnby.jsView on unpkg · L10126dist/chunk-y0jbp8gx.jsView file
3160init_src();
L3161: import { spawnSync } from "child_process";
L3162: import { dirname as dirname2, join as join6 } from "path";
High
Child Process
Package source references child process execution.
dist/chunk-y0jbp8gx.jsView on unpkg · L31603947return;
L3948: const { initReplBridge } = await import("./chunk-838t1ak3.js");
L3949: const { shouldShowAppUpgradeMessage } = await import("./chunk-drsef320.js");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
Findings
4 Critical12 High8 Medium8 Low
CriticalCredential Exfiltrationdist/chunk-ayj2aemy.js
CriticalBrowser Credential Phishingdist/chunk-mnrth8b3.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-ayj2aemy.js
CriticalPrevious Version Dangerous Deltadist/chunk-gh05yjzb.js
HighChild Processdist/chunk-y0jbp8gx.js
HighShelldist/chunk-pn1ak6wg.js
HighEvaldist/chunk-v5h9d8pn.js
HighCredential Redirect Persistencedist/chunk-gh05yjzb.js
HighCommand Output Exfiltrationdist/chunk-mnrth8b3.js
HighSandbox Evasion Gated Capabilitydist/chunk-mnrth8b3.js
HighCloud Metadata Accessdist/chunk-q6deb5bx.js
Affected versions and remediation
This report applies to claude-code-zanii@2.14.4.
See all versions of claude-code-zanii for other recorded verdicts.
- Review the evidence and your use of claude-code-zanii@2.14.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.