registry / @companion-ai/feynman / 0.3.38
@companion-ai/feynman@0.3.38
Research-first CLI agent built on Pi and alphaXiv
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe preinstall hook only checks Node compatibility. Potentially invasive Pi setup, optional Homebrew invocation, skill installation, and telemetry occur only through explicit runtime/user-command paths and are package-aligned; no concrete malicious chain was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs the feynman CLI.
Impact
Creates Feynman runtime state and sends opt-out telemetry metadata; no credential or file exfiltration chain was found.
Mechanism
Package-owned Pi runtime setup and telemetry initialization.
AI rationale
The preinstall hook only checks Node compatibility. Potentially invasive Pi setup, optional Homebrew invocation, skill installation, and telemetry occur only through explicit runtime/user-command paths and are package-aligned; no concrete malicious chain was found.
Evidence
package.jsonscripts/check-node-version.mjsbin/feynman.jsscripts/patch-embedded-pi.mjsdist/pi/launch.jsdist/pi/runtime.jsdist/telemetry/posthog.jsscripts/install/install-skills.sh
Network endpoints1
us.i.posthog.com
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- Preinstall only runs the Node-version checker.
- Pi patching is triggered by the user-invoked feynman binary, not npm lifecycle.
- Runtime telemetry targets PostHog and labels Pi capture metadata-only.
Evidence against
- No install-time downloader, credential harvesting, or exfiltration was found.
- The bundled archive is a 59.8 MB runtime workspace with a recorded SHA-256, not an inert hidden payload.
- Runtime writes are package-aligned Feynman/Pi setup; no foreign broad agent-control write occurs during install.
- The skills installer is an explicit user command with a selected target directory.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
13 flaggedpackage.jsonView file
•scripts.preinstall = node ./scripts/check-node-version.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/feynman.jsView file
25if (compareNodeVersions(parsedNodeVersion, parseNodeVersion(MIN_NODE_VERSION)) < 0 || parsedNodeVersion.major > MAX_NODE_MAJOR) {
L26: const isWindows = process.platform === "win32";
L27: console.error(`feynman supports Node.js ${MIN_NODE_VERSION} through ${MAX_NODE_MAJOR}.x (detected ${process.versions.node}).`);
...
L30: : isWindows
L31: ? "Install a supported Node.js release from https://nodejs.org, or use the standalone installer:"
L32: : `Switch to a supported Node release with \`nvm install ${PREFERRED_NODE_MAJOR} && nvm use ${PREFERRED_NODE_MAJOR}\`, or use the standalone installer:`);
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/feynman.jsView on unpkg · L25Findings
1 Critical6 High9 Medium7 Low
CriticalTrojan Source Unicodedist/workbench-web/assets/index-BNB2OrGw.js
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitybin/feynman.js
HighShips High Entropy Blob.feynman/runtime-workspace.tgz
HighPayload In Excluded Dir.feynman/runtime-workspace.tgz
HighSemantic Analysis Limiteddist/workbench-web/assets/dist-DQ8bJuTd.js
HighPrevious Version Dangerous Deltascripts/verify-installed-runtime.mjs
MediumDynamic Requirebin/feynman.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Wasm Moduledist/workbench-web/assets/RDKit_minimal-tnscgqxm.wasm
Affected versions and remediation
This report applies to @companion-ai/feynman@0.3.38.
See all versions of @companion-ai/feynman for other recorded verdicts.
- Review the evidence and your use of @companion-ai/feynman@0.3.38 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.