registry / @companion-ai/feynman / 0.3.30
@companion-ai/feynman@0.3.30
Research-first CLI agent built on Pi and alphaXiv
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has a user-triggered mechanism that rewrites an embedded AI-agent runtime, which warrants a warning. The inspected install hook is only a version check, and no concrete exfiltration or destructive behavior was established.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A user invokes the feynman command.
Impact
This is a first-party AI-agent runtime modification surface, but it is user-command gated and no confirmed malicious payload or exfiltration path was found.
Mechanism
The launcher imports scripts/patch-embedded-pi.mjs, which conditionally writes patched Pi runtime files and can restore its packaged runtime workspace.
AI rationale
The package has a user-triggered mechanism that rewrites an embedded AI-agent runtime, which warrants a warning. The inspected install hook is only a version check, and no concrete exfiltration or destructive behavior was established.
Evidence
bin/feynman.jsscripts/patch-embedded-pi.mjsnode_modules/@earendil-works/pi-coding-agent/dist/core/model-registry.js.feynman/runtime-workspace.tgz
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The feynman CLI imports a runtime patch script before loading its main program.
- The runtime patcher rewrites embedded Pi model-registry source when its patch changes the file.
- The patcher extracts a bundled runtime workspace after checking its SHA-256 digest.
Evidence against
- The only npm lifecycle hook runs a Node-version check rather than the patcher.
- The Hugging Face token is sent only in requests built from the fixed huggingface.co base URL.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
24 flaggedpackage.jsonView file
•scripts.preinstall = node ./scripts/check-node-version.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/setup/preview.jsView file
1import { spawnSync } from "node:child_process";
L2: import { BREW_FALLBACK_PATHS, PANDOC_FALLBACK_PATHS, resolveExecutable } from "../system/executables.js";
High
Child Process
Package source references child process execution.
dist/setup/preview.jsView on unpkg · L1extensions/research-tools/workbench-connectors.tsView file
361
Findings
1 Critical14 High9 Medium8 Low
CriticalTrojan Source Unicodedist/workbench-web/assets/index-Dn1dPtCn.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/setup/preview.js
HighShellextensions/research-tools/workbench-connectors.ts
HighSame File Env Network Executionnode_modules/@earendil-works/pi-coding-agent/node_modules/google-auth-library/build/src/auth/googleauth.js#virtual:normalized:round1
HighCommand Output Exfiltrationnode_modules/@earendil-works/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.js
HighSandbox Evasion Gated Capabilitybin/feynman.js
HighCloud Metadata Accessnode_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/fromHttp.js
HighShips High Entropy Blob.feynman/runtime-workspace.tgz
Affected versions and remediation
This report applies to @companion-ai/feynman@0.3.30.
See all versions of @companion-ai/feynman for other recorded verdicts.
- Review the evidence and your use of @companion-ai/feynman@0.3.30 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.