Loading npm security reports…

openzoo@0.51.3: AI-agent control-surface risk | LPM Firewall

registry / openzoo / 0.51.3

openzoo@0.51.3

Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental. `openzoo build|

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Explicit CLI use can redirect Cursor and Anthropic service domains to a local impersonation server. The server can bypass local approval controls, forge client login state, proxy authenticated vendor traffic, and record intercepted data.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Running the grok-cli command without --no-takeover, especially with --sniff.

Impact

The package can take control of an AI client, alter its authorization state, and expose its authenticated requests and captured session data to local files.

Mechanism

Privileged DNS hijack, client impersonation, permission bypass, and authenticated traffic capture.

Policy narrative

When invoked through its Grok Bot command, the package defaults to taking over vendor backend routing. It requests sudo to redirect service hostnames to loopback, launches a local server that impersonates those services, and disables TLS checks. It writes fake Cursor tokens to make the client appear logged in and changes the local tool policy from ask to always. In sniff mode it forwards authenticated traffic to real services while saving captured records. It also returns a fabricated active subscription profile. These actions enable unauthorized control of an AI client and interception of its authenticated traffic.

AI rationale

Source implements a privileged vendor-service takeover, forged authentication state, and bypass of local tool approval, with optional authenticated traffic capture. The absence of install hooks does not neutralize this concrete malicious capability.

Evidence

lib/grokcli.jslib/hosts.jslib/cursorbackend.js/etc/hosts/etc/hosts.openzoo-backup

Source & flagged code

10 flagged · loading source

bin/claude-zoo.jsView file

17*/ L18: import { spawn } from 'node:child_process'; L19: import { existsSync, readdirSync as fsReaddir, readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/claude-zoo.jsView on unpkg · L17

65]) { L66: try { execSync(cmd, { stdio: 'ignore', timeout: 2000, shell: true }); } catch { /* missing */ } L67: }

High

Shell

Package source references shell execution.

bin/claude-zoo.jsView on unpkg · L65

50L51: const PROXY_PORT = Number(process.env.OPENZOO_PROXY_PORT || 8402); L52: const PROXY_URL = `http://localhost:${PROXY_PORT}/v1`; L53: ... L65: ]) { L66: try { execSync(cmd, { stdio: 'ignore', timeout: 2000, shell: true }); } catch { /* missing */ } L67: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/claude-zoo.jsView on unpkg · L50

transmute/lib/eligibility.jsView file

119document: '`document` does not exist in a Lambda', L120: eval: 'eval() is not supported', L121: Function: 'the Function constructor is not supported',

Low

Eval

Package source references a known benign dynamic code generation pattern.

transmute/lib/eligibility.jsView on unpkg · L119

lib/xbot.jsView file

26L27: const GATEWAY = process.env.OPENZOO_GATEWAY || 'https://x402-tokens.fly.dev'; L28: /** ... L134: * acceptable: there is nothing in it that its author did not already publish. L135: * Do not reuse this pattern anywhere the material is private — a shared context L136: * means any question can recall any bound slice. ... L140: const STATE_FILE = process.env.OPENZOO_XBOT_STATE L141: || path.join(os.homedir(), '.openzoo', 'xbot.json'); L142: ... L151: try { L152: const d = JSON.parse(fs.readFileSync(file, 'utf8')); L153: return {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/xbot.jsView on unpkg · L26

lib/worktree.mjsView file

130return project L131: ? `https://gitlab.com/api/v4/projects/${encodeURIComponent(project)}/merge_requests/${n}` L132: : null; ... L140: if (!r.ok) process.exit(1); L141: process.stdout.write(await r.text()); L142: `; L143: const body = execFileSync(process.execPath, ['--input-type=module', '-e', src], { L144: encoding: 'utf8',

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/worktree.mjsView on unpkg · L130

bin/openzoo.jsView file

3Cross-file remote execution chain: bin/openzoo.js spawns transmute/lib/cli.js; helper contains network access plus dynamic code execution. L3: // L4: // package.json says engines >=18 but npm only WARNS, so an old node walked L5: // straight in and died somewhere useless: there is no global `fetch` before 18, ... L16: import { existsSync, readdirSync } from 'fs'; L17: import { execFileSync, spawnSync } from 'child_process'; L18: import { homedir } from 'os'; ... L22: const MIN_NODE = 18; L23: if (Number(process.versions.node.split('.')[0]) < MIN_NODE && !process.env.OPENZOO_NODE_REEXEC) { L24: const candidates = ['/opt/homebrew/bin/node', '/usr/local/bin/node', '/usr/bin/node'].filter(existsSync); ... L27: try { L28: const nvm = join(process.env.NVM_DIR || join(homedir(), '.nvm'), 'version

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/openzoo.jsView on unpkg · L3

transmute/prebuilt/zoo_vm.v0.soView file

•path = transmute/prebuilt/zoo_vm.v0.so kind = native_binary sizeBytes = 313584 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

transmute/prebuilt/zoo_vm.v0.soView on unpkg

lib/aoe.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/aoe.js#virtual:normalized:round1View on unpkg

lib/cursorbackend.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = openzoo@0.50.55 matchedIdentity = npm:b3Blbnpvbw:0.50.55 similarity = 0.648 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/cursorbackend.jsView on unpkg

Source & flagged code

10 flagged

bin/claude-zoo.jsView file

Lines 1-85javascript

1#!/usr/bin/env node

2/**

3 * `claude` — the openzoo-backed Claude Code command.

4 *

5 * Replaces the raw occ launcher. Same binary, but every request goes through

6 * the local openzoo proxy on :8402 (x402 per-call payment, no Anthropic

7 * subscription, no login):

8 *

9 * - starts the proxy if it is not already THIS version on :8402 (steals stale)

10 * - applies claudeZooEnv(): ANTHROPIC_BASE_URL=localhost:PORT/v1,

11 * AUTH_TOKEN=sk-openzoo, ANTHROPIC_API_KEY deleted, compaction disabled

12 * (the proxy binds the prefix), 1M-token ceiling restored

13 * - execs occ (open-claude-code) with your original argv

14 *

15 * The old direct-to-Anthropic-capable launcher is preserved as

16 * `claude-code-cli` (same directory, symlinked to occ).

17 */

18import { spawn } from 'node:child_process';

19import { existsSync, readdirSync as fsReaddir, readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/claude-zoo.jsView on unpkg · L17

20import { execSync } from 'node:child_process';

21import { homedir, platform } from 'node:os';

22import { dirname, join, sep } from 'node:path';

23import { fileURLToPath } from 'node:url';

24

25const here = dirname(fileURLToPath(import.meta.url));

26const shimRoot = dirname(here);

27

28// occ lives beside us (nvm bin/occ) or, if this wrapper is copied elsewhere,

29// we fall back to searching the nvm tree we were installed from.

30function findOcc() {

31 const candidate = join(here, 'occ');

32 if (existsSync(candidate)) return candidate;

33 {

34 const versions = join(homedir(), '.nvm', 'versions', 'node');

35 try {

36 for (const v of fsReaddir(versions).sort().reverse()) {

37 const p = join(versions, v, 'bin', 'occ');

38 if (existsSync(p)) return p;

39 }

40 } catch { /* fall through */ }

41 }

42 return null;

43}

44

45const occ = findOcc();

46if (!occ) {

47 console.error('claude: cannot find occ (open-claude-code) next to this wrapper.');

48 process.exit(1);

49}

50

51const PROXY_PORT = Number(process.env.OPENZOO_PROXY_PORT || 8402);

52const PROXY_URL = `http://localhost:${PROXY_PORT}/v1`;

53

54function mineVersion() {

55 try {

56 return JSON.parse(readFileSync(join(shimRoot, 'package.json'), 'utf8')).version;

57 } catch { return ''; }

58}

59

60function stealPort(port) {

61 const n = Number(port);

62 for (const cmd of [

63 `lsof -t -iTCP:${n} -sTCP:LISTEN | xargs kill -9`,

64 `fuser -k ${n}/tcp`,

65 ]) {

66 try { execSync(cmd, { stdio: 'ignore', timeout: 2000, shell: true }); } catch { /* missing */ }

67 }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/claude-zoo.jsView on unpkg · L50

High

Shell

Package source references shell execution.

bin/claude-zoo.jsView on unpkg · L65

68}

69

70async function proxyUp() {

71 try {

72 const r = await fetch(`http://localhost:${PROXY_PORT}/v1/info`, { signal: AbortSignal.timeout(1500) });

73 if (!r.ok) return false;

74 const j = await r.json().catch(() => ({}));

75 const mine = mineVersion();

76 if (mine && String(j.version || '') !== mine) {

77 console.error(`claude: stale proxy v${j.version || '?'} on :${PROXY_PORT} — stealing for v${mine}`);

78 stealPort(PROXY_PORT);

79 return false;

80 }

81 return true;

82 } catch { return false; }

83}

84

85async function ensureProxy() {

transmute/lib/eligibility.jsView file

Lines 99-139javascript

99 'undefined', 'NaN', 'Infinity', 'Math', 'JSON', 'Object', 'Array', 'Number', 'String', 'Boolean', 'parseInt', 'parseFloat',

100 'isNaN'

lib/xbot.jsView file

Lines 6-46javascript

6 * would have cost on OpenRouter. That receipt is the product — a reply that

7 * just answers is a worse @grok, a reply that prices itself is the pitch.

8 *

9 * WHY THE COMPARISON IS AGAINST A NAMED

lib/worktree.mjsView file

Lines 110-150javascript

110 }

111}

112

113export function githubRepoFromOrigin(originUrl) {

114 const m = /github\.com[:/]([^/]+)

bin/openzoo.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2// NODE >=18 OR NOTHING — AND HEAL IT IF WE CAN.

3//

4// package.json says engines >=18 but npm only WARNS, so an old node walked

5// straight in and died somewhere useless: there is no global `fetch` before 18,

6// so the very first probe threw, a bare `catch` swallowed it, and the user was

7// left staring at "starting the proxy in the background..." forever with no

8// error to report. Reported from the wild on macOS.

9//

10// Detect-and-exit is not enough when the machine usually HAS a good node sitting

transmute/prebuilt/zoo_vm.v0.soView file

•path = transmute/prebuilt/zoo_vm.v0.so kind = native_binary sizeBytes = 313584 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

transmute/prebuilt/zoo_vm.v0.soView on unpkg

lib/aoe.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/aoe.js#virtual:normalized:round1View on unpkg

lib/cursorbackend.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = openzoo@0.50.55 matchedIdentity = npm:b3Blbnpvbw:0.50.55 similarity = 0.648 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/cursorbackend.jsView on unpkg