registry / @hachej/boring-workspace / 0.1.63

@hachej/boring-workspace@0.1.63

Workspace UI, plugin, and bridge package for composing chat, files, catalogs, editors, and app-specific panes.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package provides a host-invoked local plugin framework that may load configured extension modules and access workspace files through its API.

Static reason

No blocking static signals were detected.

Trigger

A host application explicitly provisions or loads workspace/PI plugins at runtime.

Impact

Host-configured plugin code can run with the host application's permissions; this package does not itself establish exfiltration or install-time mutation.

Mechanism

Configured local plugin discovery and dynamic module import.

Rationale

The flagged primitives implement the advertised workspace and agent-plugin framework, are activated by host runtime configuration, and remote PI sources are explicitly excluded. There is no lifecycle execution or concrete malicious chain in the inspected package source.

Evidence

package.jsondist/server.jsdist/app-server.jsdist/WorkspaceProvider-U4izhS84.js

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/app-server.js` discovers configured local `.pi` plugin directories, including `~/.pi/agent/extensions`.
`dist/server.js` dynamically imports server plugin modules supplied by the host/plugin configuration.

Evidence against

`package.json` has no `preinstall`, `install`, `postinstall`, or `prepare` lifecycle hook.
`dist/app-server.js` rejects `npm:`, `git:`, `github:`, `http:`, `https:`, and `ssh:` sources when resolving PI settings.
No `child_process`, shell execution, credential harvesting, or outbound hard-coded endpoint was found in distributed runtime files.
Filesystem write/removal paths in `dist/app-server.js` support workspace/plugin error and provisioning operations rather than install-time persistence.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 1.10 MB of source, external domains: github.com, html.spec.whatwg.org, react.dev, testing-library.com, testing-playground.com, workspace.local, workspace.testing

Source & flagged code

1 flagged

dist/server.jsView file

Lines 2230-2270javascript

2230 }));

2231 const routeContributions = finalPlugins.filter((p) => p.routes).map((p) => ({ id: p.id, routes: p.routes }));

2232 const workspaceBridgeHandlers = finalPlugins.flatMap((p) => p.workspaceBridgeHandlers ?? []);

2233 const preservedUiStateKeys = [...new Set(finalPlugins.flatMap((p) => p.preservedUiStateKeys ?? []))];

2234 return {

2235 registered: finalPlugins.map((p) => p.id),

2236 systemPromptAppend,

2237 piPackages,

2238 extensionPaths,

2239 agentTools,

2240 runtimePlugins,

2241 provisioningContributions,

2242 routeContributions,

2243 workspaceBridgeHandlers,

2244 preservedUiStateKeys

2245 };

2246}

2247

2248// src/server/boringSystemPrompt.ts

2249import { createRequire } from "module";

2250import { dirname as dirname2, join as join2 } from "path";

2251var require2 = createRequire(import.meta.url);

2252function resolveBoringPiRoot(override) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server.jsView on unpkg · L2250

2253 if (override === null) return null;

2254 if (override) return override;

2255 try {

2256 return dirname2(require2.resolve("@hachej/boring-pi/package.json"));

2257 } catch {

2258 return null;

2259 }

2260}

2261function buildDocsRefs(boringPiRoot) {

2262 return [

2263 {

2264 topic: "Workflow + how-to + full plugin authoring reference",

2265 path: join2(boringPiRoot, "skills/boring-plugin-authoring/SKILL.md")

2266 },

2267 {

2268 topic: "Panels (registration, dockview, layout)",

2269 path: join2(boringPiRoot, "references/workspace/panels.md")

2270 },

Source & flagged code

1 flagged · loading source

dist/server.jsView file

2250import { dirname as dirname2, join as join2 } from "path"; L2251: var require2 = createRequire(import.meta.url); L2252: function resolveBoringPiRoot(override) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server.jsView on unpkg · L2250

Findings

3 Medium4 Low

MediumDynamic Requiredist/server.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/server.jsView file

Lines 2230-2270javascript

2230 }));

2231 const routeContributions = finalPlugins.filter((p) => p.routes).map((p) => ({ id: p.id, routes: p.routes }));

2232 const workspaceBridgeHandlers = finalPlugins.flatMap((p) => p.workspaceBridgeHandlers ?? []);

2233 const preservedUiStateKeys = [...new Set(finalPlugins.flatMap((p) => p.preservedUiStateKeys ?? []))];

2234 return {

2235 registered: finalPlugins.map((p) => p.id),

2236 systemPromptAppend,

2237 piPackages,

2238 extensionPaths,

2239 agentTools,

2240 runtimePlugins,

2241 provisioningContributions,

2242 routeContributions,

2243 workspaceBridgeHandlers,

2244 preservedUiStateKeys

2245 };

2246}

2247

2248// src/server/boringSystemPrompt.ts

2249import { createRequire } from "module";

2250import { dirname as dirname2, join as join2 } from "path";

2251var require2 = createRequire(import.meta.url);

2252function resolveBoringPiRoot(override) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server.jsView on unpkg · L2250

2253 if (override === null) return null;

2254 if (override) return override;

2255 try {

2256 return dirname2(require2.resolve("@hachej/boring-pi/package.json"));

2257 } catch {

2258 return null;

2259 }

2260}

2261function buildDocsRefs(boringPiRoot) {

2262 return [

2263 {

2264 topic: "Workflow + how-to + full plugin authoring reference",

2265 path: join2(boringPiRoot, "skills/boring-plugin-authoring/SKILL.md")

2266 },

2267 {

2268 topic: "Panels (registration, dockview, layout)",

2269 path: join2(boringPiRoot, "references/workspace/panels.md")

2270 },