@firstpick/pi-package-webui@0.6.3: Clean npm security report | LPM Firewall

Loading npm security reports…

@firstpick/pi-package-webui@0.6.3: Clean npm security report | LPM Firewall

Source & flagged code

7 flagged · loading source

bin/pi-webui.mjsView file

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { createHash, randomInt, randomUUID, timingSafeEqual } from "node:crypto"; L4: import { createReadStream } from "node:fs"; L5: import { createServer } from "node:http"; L6: import { createRequire } from "node:module"; ... L48: L49: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L50: const require = createRequire(import.meta.url); ... L53: const webuiHelperExtensionPath = path.join(packageRoot, "webui-rpc-helper.mjs"); L54: const agentDir = process.env.PI_CODING_AGENT_DIR || path.join(homedir(), ".pi", "agent"); L55: const OPTIONAL_FEATURE_INSTALL_ROOT_ENV = "PI_WEBUI_OPTIONAL_FEATURE_INSTALL_ROOT";

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

bin/pi-webui.mjsView on unpkg · L1

1Trigger-reachable chain: manifest.bin -> bin/pi-webui.mjs L1: #!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { createHash, randomInt, randomUUID, timingSafeEqual } from "node:crypto"; L4: import { createReadStream } from "node:fs"; L5: import { createServer } from "node:http"; L6: import { createRequire } from "node:module"; ... L48: L49: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L50: const require = createRequire(import.meta.url); ... L53: const webuiHelperExtensionPath = path.join(packageRoot, "webui-rpc-helper.mjs"); L54: const agentDir = process.env.PI_CODING_AGENT_DIR || path.join(homedir(), ".pi", "agent"); L55: const OPTIONAL_FEATURE_INSTALL_ROOT_ENV = "PI_WEBUI_OPTIONAL_FEATURE_INSTALL_ROOT";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/pi-webui.mjsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @firstpick/pi-package-webui@0.6.2 matchedIdentity = npm:[redacted]:0.6.2 similarity = 0.815 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/pi-webui.mjsView on unpkg

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { createHash, randomInt, randomUUID, timingSafeEqual } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/pi-webui.mjsView on unpkg · L1

49const __dirname = path.dirname(fileURLToPath(import.meta.url)); L50: const require = createRequire(import.meta.url); L51: const packageRoot = path.resolve(__dirname, "..");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/pi-webui.mjsView on unpkg · L49

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { createHash, randomInt, randomUUID, timingSafeEqual } from "node:crypto"; L4: import { createReadStream } from "node:fs"; L5: import { createServer } from "node:http"; L6: import { createRequire } from "node:module"; ... L48: L49: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L50: const require = createRequire(import.meta.url); ... L53: const webuiHelperExtensionPath = path.join(packageRoot, "webui-rpc-helper.mjs"); L54: const agentDir = process.env.PI_CODING_AGENT_DIR || path.join(homedir(), ".pi", "agent"); L55: const OPTIONAL_FEATURE_INSTALL_ROOT_ENV = "PI_WEBUI_OPTIONAL_FEATURE_INSTALL_ROOT";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/pi-webui.mjsView on unpkg · L1

tests/http-endpoints-harness.test.mjsView file

97L98: const child = spawn(process.execPath, [serverScript, "--cwd", cwd, "--host", "0.0.0.0", "--port", String(port), "--pi", fakePi], { L99: stdio: ["ignore", "pipe", "pipe"], L100: env: { L101: ...process.env, L102: GIT_AUTHOR_NAME: "Pi WebUI Test", ... L106: PI_WEBUI_SETTINGS_FILE: settingsFile, L107: PI_VOICE_STT_URL: `http://127.0.0.1:${voiceProviderPort}/stt`, L108: PI_VOICE_TTS_URL: `http://127.0.0.1:${voiceProviderPort}/tts`,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

tests/http-endpoints-harness.test.mjsView on unpkg · L97

Source & flagged code

7 flagged

bin/pi-webui.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { createHash, randomInt, randomUUID, timingSafeEqual } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/pi-webui.mjsView on unpkg · L1

4import { createReadStream } from "node:fs";

5import { createServer } from "node:http";

6import { createRequire } from "node:module";

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

bin/pi-webui.mjsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/pi-webui.mjsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/pi-webui.mjsView on unpkg · L1

7import { access, copyFile, mkdir, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";

8import { homedir, networkInterfaces, platform, tmpdir } from "node:os";

9import path from "node:path";

10import { StringDecoder } from "node:string_decoder";

11import { fileURLToPath, pathToFileURL } from "node:url";

12import { promisify } from "node:util";

13import { brotliCompress, constants as zlibConstants, gzip } from "node:zlib";

14import { AuthStorage, SessionManager, SettingsManager, DefaultPackageManager } from "@earendil-works/pi-coding-agent";

15import { authProvidersPayload, createAuthContext, logoutStoredProvider } from "../lib/auth-actions.mjs";

16import {

17 collectOpenSessionFiles,

18 deleteSessionFile,

19 isSessionPathAllowed,

20 renameSessionMetadata,

21 validateSessionDelete,

Lines 29-69javascript

29 requireLocalhost,

30 requireLocalhostRoute,

31} from "../lib/trust-boundaries.mjs";

32import {

33 nativeCommandBlocked,

34 nativeCommandResponse,

35 nativeCommandUnavailable,

36 nativeSlashCommandEntries,

37 parseSlashCommand as parseNativeSlashCommand,

38} from "../lib/native-command-adapter.mjs"

•matchType = previous_version_dangerous_delta matchedPackage = @firstpick/pi-package-webui@0.6.2 matchedIdentity = npm:[redacted]:0.6.2 similarity = 0.815 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/pi-webui.mjsView on unpkg

tests/http-endpoints-harness.test.mjsView file

Lines 77-117javascript

77const voiceProvider = createServer(async (req, res) => {

78 const chunks = [];

79 for