Malware in @zaip-ai/cli
- Product
- @zaip-ai/cli
- Affected
- @zaip-ai/cli 6.4.0, 6.5.0, 7.0.0, 7.1.0, 7.2.0, 7.3.0, 7.4.0
- Fixed in
- No fix yet
Last verified against sources: October 29, 2026
Am I affected?
@zaip-ai/cli: affected @zaip-ai/cli 6.4.0, 6.5.0, 7.0.0, 7.1.0, 7.2.0, 7.3.0, 7.4.0. No fix has been reported yet.
- Check your version: run
npm ls @zaip-ai/cli. Versions = 6.4.0 of @zaip-ai/cli are affected. [1]
What to do now
- Remove the package if it is installed: run
npm uninstall @zaip-ai/cli. [1] - Rotate all secrets and keys stored on that computer immediately from a different computer. [1]
- Remove the package. [1]
- No fix is available yet. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- Malware in @zaip-ai/cli. [1]
- Any computer that has this package installed or running should be considered fully compromised. [1]
- The package should be removed. [1]
- As full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. [1]
Impact
What was done
- No patched version is available. [1]
Sources
- GHSA-ffq4-h5jm-8pqr — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
Malware in @zaip-ai/cli
Product: @zaip-ai/cli | Affected: @zaip-ai/cli 6.4.0, 6.5.0, 7.0.0, 7.1.0, 7.2.0, 7.3.0, 7.4.0 | Fixed in: No fix yet
Summary: Malware in @zaip-ai/cli.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/10/ghsa-ffq4-h5jm-8pqr-zaip-ai-cliCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for @zaip-ai/cli
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.