claude-code-zanii@2.14.5
Reverse-engineered Anthropic Claude Code CLI — interactive AI coding assistant in the terminal
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe source shows automatic recording of tool names and outcomes, with a ledger submission path, but does not resolve the recipient configuration or consent. The inspected call does not pass tool inputs or outputs, so it does not establish a concrete data-exfiltration attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
CLI startup and tool execution.
Impact
The observed records disclose tool names and success status; the recipient configuration and user consent were not resolved.
Mechanism
Tool execution calls a Zanii recording helper, and the SDK batches receipts for submission to its configured server.
AI rationale
The source shows automatic recording of tool names and outcomes, with a ledger submission path, but does not resolve the recipient configuration or consent. The inspected call does not pass tool inputs or outputs, so it does not establish a concrete data-exfiltration attack.
Decision evidence
public snapshotAI called this Suspicious at 63.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package declares @zanii/sdk as a runtime dependency.
- Tool execution records tool names and outcomes through a Zanii recording helper.
- The recording helper is initialized as part of tool execution setup.
- The Zanii SDK submits queued receipts to its configured server endpoint.
- A startup UI component requests and displays Zanii ledger proof status.
- The Axios helper assigns mTLS agents to requests whose URLs pass the proxy-bypass check.
- The debug logger writes messages to stderr or its debug writer.
- Claude in Chrome setup creates a wrapper script and then installs the native-host manifest.
Evidence against
- The inspected tool-call recorder invocation passes the tool name and a success flag, not the tool input or output.
- The inspected source does not establish that sensitive prompt or tool content is sent to the ledger.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem
Source & flagged code
30 flaggeddist/chunk-xxx0ngnd.jsView file
•matchType = normalized_sha256
matchedPackage = claude-code-zanii@2.14.4
matchedPath = dist/chunk-rhj0dnby.js
matchedIdentity = npm:Y2xhdWRlLWNvZGUtemFuaWk:2.14.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-xxx0ngnd.jsView on unpkg10126patternName = generic_password
severity = medium
line = 10126
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/chunk-xxx0ngnd.jsView on unpkg · L10126dist/chunk-hq40zj2w.jsView file
50// node_modules/@aws-sdk/credential-provider-process/dist-es/resolveProcessCredentials.js
L51: import { exec } from "child_process";
L52: import { promisify } from "util";
Findings
3 Critical22 High7 Medium9 Low
CriticalCredential Exfiltrationdist/chunk-yq177vef.js
CriticalBrowser Credential Phishingdist/chunk-mnrth8b3.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-yq177vef.js
HighChild Processdist/chunk-hq40zj2w.js
HighShelldist/chunk-yq177vef.js
HighCredential Redirect Persistencedist/chunk-7rgxqmg6.js
HighCommand Output Exfiltrationdist/chunk-mnrth8b3.js
HighSandbox Evasion Gated Capabilityscripts/postinstall.cjs
HighCloud Metadata Accessdist/chunk-mnrth8b3.js
HighInstall Named Payload Filescripts/postinstall.cjs
HighCross File Remote Execution Contextdist/chunk-1nnc8vgh.js
Affected versions and remediation
This report applies to claude-code-zanii@2.14.5.
See all versions of claude-code-zanii for other recorded verdicts.
- Review the evidence and your use of claude-code-zanii@2.14.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.