Loading npm security reports…

openzoo@0.50.100: AI-agent control-surface risk | LPM Firewall

registry / openzoo / 0.50.100

openzoo@0.50.100

Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The explicit Cursor takeover feature redirects vendor and agent hosts to a local impersonation server. It forges paid membership state and weakens certificate validation to bypass vendor controls.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user runs the Cursor command with takeover enabled; ordinary Cursor setup also attempts a privileged backend host block unless disabled.

Impact

Cursor and agent traffic can be intercepted locally and unpaid accounts can be presented as entitled.

Mechanism

Host-file redirection, TLS impersonation, and membership forgery.

Policy narrative

When invoked, the package can use sudo to add loopback mappings for Cursor and agent backend hosts. In takeover mode it creates certificates for those vendor names, disables Cursor certificate checks, and serves an active paid membership response. It also modifies Cursor's local cached Stripe membership and subscription state. This redirects the editor to a package-controlled server and bypasses its subscription and model-selection controls.

AI rationale

The package contains a concrete editor-control hijack and paid-tier bypass, not merely a user-configured proxy. Although it has no install hook, the explicit runtime path performs privileged host mutation, TLS impersonation, and membership forgery.

Evidence

lib/setup.jslib/hosts.jslib/cursorbackend.jslib/cursorcfg.js/etc/hosts~/.openzoo/cursor-tls/cert.pem~/.openzoo/cursor-tls/key.pemCursor ItemTable

Source & flagged code

7 flagged · loading source

bin/claude-zoo.jsView file

17*/ L18: import { spawn } from 'node:child_process'; L19: import { existsSync, readdirSync as fsReaddir, readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/claude-zoo.jsView on unpkg · L17

65]) { L66: try { execSync(cmd, { stdio: 'ignore', timeout: 2000, shell: true }); } catch { /* missing */ } L67: }

High

Shell

Package source references shell execution.

bin/claude-zoo.jsView on unpkg · L65

50L51: const PROXY_PORT = Number(process.env.OPENZOO_PROXY_PORT || 8402); L52: const PROXY_URL = `http://localhost:${PROXY_PORT}/v1`; L53: ... L65: ]) { L66: try { execSync(cmd, { stdio: 'ignore', timeout: 2000, shell: true }); } catch { /* missing */ } L67: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/claude-zoo.jsView on unpkg · L50

lib/xbot.jsView file

26L27: const GATEWAY = process.env.OPENZOO_GATEWAY || 'https://x402-tokens.fly.dev'; L28: /** ... L134: * acceptable: there is nothing in it that its author did not already publish. L135: * Do not reuse this pattern anywhere the material is private — a shared context L136: * means any question can recall any bound slice. ... L140: const STATE_FILE = process.env.OPENZOO_XBOT_STATE L141: || path.join(os.homedir(), '.openzoo', 'xbot.json'); L142: ... L151: try { L152: const d = JSON.parse(fs.readFileSync(file, 'utf8')); L153: return {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/xbot.jsView on unpkg · L26

lib/worktree.mjsView file

130return project L131: ? `https://gitlab.com/api/v4/projects/${encodeURIComponent(project)}/merge_requests/${n}` L132: : null; ... L140: if (!r.ok) process.exit(1); L141: process.stdout.write(await r.text()); L142: `; L143: const body = execFileSync(process.execPath, ['--input-type=module', '-e', src], { L144: encoding: 'utf8',

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/worktree.mjsView on unpkg · L130

lib/aoe.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/aoe.js#virtual:normalized:round1View on unpkg

lib/cursorbackend.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = openzoo@0.50.55 matchedIdentity = npm:b3Blbnpvbw:0.50.55 similarity = 0.648 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/cursorbackend.jsView on unpkg

Source & flagged code

7 flagged

bin/claude-zoo.jsView file

Lines 1-85javascript

1#!/usr/bin/env node

2/**

3 * `claude` — the openzoo-backed Claude Code command.

4 *

5 * Replaces the raw occ launcher. Same binary, but every request goes through

6 * the local openzoo proxy on :8402 (x402 per-call payment, no Anthropic

7 * subscription, no login):

8 *

9 * - starts the proxy if it is not already THIS version on :8402 (steals stale)

10 * - applies claudeZooEnv(): ANTHROPIC_BASE_URL=localhost:PORT/v1,

11 * AUTH_TOKEN=sk-openzoo, ANTHROPIC_API_KEY deleted, compaction disabled

12 * (the proxy binds the prefix), 1M-token ceiling restored

13 * - execs occ (open-claude-code) with your original argv

14 *

15 * The old direct-to-Anthropic-capable launcher is preserved as

16 * `claude-code-cli` (same directory, symlinked to occ).

17 */

18import { spawn } from 'node:child_process';

19import { existsSync, readdirSync as fsReaddir, readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/claude-zoo.jsView on unpkg · L17

20import { execSync } from 'node:child_process';

21import { homedir, platform } from 'node:os';

22import { dirname, join, sep } from 'node:path';

23import { fileURLToPath } from 'node:url';

24

25const here = dirname(fileURLToPath(import.meta.url));

26const shimRoot = dirname(here);

27

28// occ lives beside us (nvm bin/occ) or, if this wrapper is copied elsewhere,

29// we fall back to searching the nvm tree we were installed from.

30function findOcc() {

31 const candidate = join(here, 'occ');

32 if (existsSync(candidate)) return candidate;

33 {

34 const versions = join(homedir(), '.nvm', 'versions', 'node');

35 try {

36 for (const v of fsReaddir(versions).sort().reverse()) {

37 const p = join(versions, v, 'bin', 'occ');

38 if (existsSync(p)) return p;

39 }

40 } catch { /* fall through */ }

41 }

42 return null;

43}

44

45const occ = findOcc();

46if (!occ) {

47 console.error('claude: cannot find occ (open-claude-code) next to this wrapper.');

48 process.exit(1);

49}

50

51const PROXY_PORT = Number(process.env.OPENZOO_PROXY_PORT || 8402);

52const PROXY_URL = `http://localhost:${PROXY_PORT}/v1`;

53

54function mineVersion() {

55 try {

56 return JSON.parse(readFileSync(join(shimRoot, 'package.json'), 'utf8')).version;

57 } catch { return ''; }

58}

59

60function stealPort(port) {

61 const n = Number(port);

62 for (const cmd of [

63 `lsof -t -iTCP:${n} -sTCP:LISTEN | xargs kill -9`,

64 `fuser -k ${n}/tcp`,

65 ]) {

66 try { execSync(cmd, { stdio: 'ignore', timeout: 2000, shell: true }); } catch { /* missing */ }

67 }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/claude-zoo.jsView on unpkg · L50

High

Shell

Package source references shell execution.

bin/claude-zoo.jsView on unpkg · L65

68}

69

70async function proxyUp() {

71 try {

72 const r = await fetch(`http://localhost:${PROXY_PORT}/v1/info`, { signal: AbortSignal.timeout(1500) });

73 if (!r.ok) return false;

74 const j = await r.json().catch(() => ({}));

75 const mine = mineVersion();

76 if (mine && String(j.version || '') !== mine) {

77 console.error(`claude: stale proxy v${j.version || '?'} on :${PROXY_PORT} — stealing for v${mine}`);

78 stealPort(PROXY_PORT);

79 return false;

80 }

81 return true;

82 } catch { return false; }

83}

84

85async function ensureProxy() {

lib/xbot.jsView file

Lines 6-46javascript

6 * would have cost on OpenRouter. That receipt is the product — a reply that

7 * just answers is a worse @grok, a reply that prices itself is the pitch.

8 *

9 * WHY THE COMPARISON IS AGAINST A NAMED

lib/worktree.mjsView file

Lines 110-150javascript

110 }

111}

112

113export function githubRepoFromOrigin(originUrl) {

114 const m = /github\.com[:/]([^/]+)

lib/aoe.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/aoe.js#virtual:normalized:round1View on unpkg

lib/cursorbackend.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = openzoo@0.50.55 matchedIdentity = npm:b3Blbnpvbw:0.50.55 similarity = 0.648 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/cursorbackend.jsView on unpkg