registry / @companion-ai/feynman / 0.3.46
@companion-ai/feynman@0.3.46
Research-first CLI agent built on Pi and alphaXiv
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has a real, user-triggered agent-runtime patching capability, so it should be warned for lifecycle risk. Its preinstall hook is only a Node-version check, and inspection found no concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs the feynman CLI.
Impact
Changes to the agent runtime may affect subsequent Feynman and Pi behavior within the managed installation.
Mechanism
Runtime rewriting of Pi dependency source and Feynman-managed agent workspace setup.
AI rationale
The package has a real, user-triggered agent-runtime patching capability, so it should be warned for lifecycle risk. Its preinstall hook is only a Node-version check, and inspection found no concrete malicious behavior.
Evidence
package.jsonbin/feynman.jsscripts/check-node-version.mjsscripts/patch-embedded-pi.mjsscripts/lib/runtime-workspace-install.mjsscripts/lib/runtime-workspace-restore.mjs.feynman/runtime-workspace.sha256.feynman/runtime-workspace.tgz.feynman/npm/node_modules/node_modules/@earendil-works/pi-coding-agent/
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The feynman command runs a local Pi patching script before loading the application.
- The patching script rewrites files in installed Pi runtime packages when its patch functions change their source.
- The runtime patch changes Pi memory handling and its child command invocation using Feynman environment variables.
- The package declares bundled Pi extensions, prompts, and skills, making this an agent-runtime extension lifecycle rather than a normal library.
Evidence against
- The only preinstall hook checks the supported Node.js version and does not write files or make network requests.
- The patching path is activated by running the feynman command, not by npm installation.
- The packaged runtime archive has a recorded SHA-256 digest and an explicit runtime dependency manifest.
- No source evidence established credential harvesting, secret exfiltration, destructive behavior, or an unconsented install-time write to a broad foreign agent configuration.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
13 flaggedpackage.jsonView file
•scripts.preinstall = node ./scripts/check-node-version.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/feynman.jsView file
25if (compareNodeVersions(parsedNodeVersion, parseNodeVersion(MIN_NODE_VERSION)) < 0 || parsedNodeVersion.major > MAX_NODE_MAJOR) {
L26: const isWindows = process.platform === "win32";
L27: console.error(`feynman supports Node.js ${MIN_NODE_VERSION} through ${MAX_NODE_MAJOR}.x (detected ${process.versions.node}).`);
...
L30: : isWindows
L31: ? "Install a supported Node.js release from https://nodejs.org, or use the standalone installer:"
L32: : `Switch to a supported Node release with \`nvm install ${PREFERRED_NODE_MAJOR} && nvm use ${PREFERRED_NODE_MAJOR}\`, or use the standalone installer:`);
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/feynman.jsView on unpkg · L25Findings
1 Critical6 High9 Medium7 Low
CriticalTrojan Source Unicodedist/workbench-web/assets/index-BNB2OrGw.js
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitybin/feynman.js
HighShips High Entropy Blob.feynman/runtime-workspace.tgz
HighPayload In Excluded Dir.feynman/runtime-workspace.tgz
HighSemantic Analysis Limiteddist/workbench-web/assets/dist-DQ8bJuTd.js
HighPrevious Version Dangerous Deltascripts/verify-installed-runtime.mjs
MediumDynamic Requirebin/feynman.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Wasm Moduledist/workbench-web/assets/RDKit_minimal-tnscgqxm.wasm
Affected versions and remediation
This report applies to @companion-ai/feynman@0.3.46.
See all versions of @companion-ai/feynman for other recorded verdicts.
- Review the evidence and your use of @companion-ai/feynman@0.3.46 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.