Am I affected by Malicious code in @zaip-ai/cli (npm)? What should I do?
Malicious code was found in @zaip-ai/cli (npm).
Affected: @zaip-ai/cli 7.3.0, 7.0.0, 7.1.0, 7.4.0, 6.5.0, 7.2.0, 6.4.0. Fixed in: no fix reported yet. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/10/mal-2026-18364-zaip-ai-cli (opens external site) Tool page: https://agentarmorhq.com/skills/cli (opens external site)
1 answer
Am I affected? Affected: @zaip-ai/cli 7.3.0, 7.0.0, 7.1.0, 7.4.0, 6.5.0, 7.2.0, 6.4.0. Fixed in: no fix reported yet.
- Check your version: run
npm ls @zaip-ai/cli. Versions 7.3.0, 7.0.0, 7.1.0, 7.4.0, 6.5.0, 7.2.0, 6.4.0 of @zaip-ai/cli are affected.
What to do now
- Remove the package if it is installed: run
npm uninstall @zaip-ai/cli. - Remove the package.
- Rotate all secrets and keys stored on that computer immediately from a different computer.
- No patched version is available.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- OSV (Open Source Vulnerabilities): https://osv.dev/MAL-2026-18364 (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/10/mal-2026-18364-zaip-ai-cli (opens external site) Tool page: https://agentarmorhq.com/skills/cli (opens external site)
Did this work for you?- Check your version: run