@howaboua/pi-durable-web@0.10.0
Codex web search and navigation for Pi Durable
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package sends an environment-derived terminal identifier with user-invoked web search requests. The disclosure is limited to the Codex request path, so this is a telemetry warning rather than evidence of a broader attack.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes the web search tool.
Impact
The service receives an environment-derived terminal identifier that is not specifically disclosed in the package documentation.
Mechanism
The package reads TERM_PROGRAM or TERM and adds the value to the User-Agent sent with the Codex request.
AI rationale
The package sends an environment-derived terminal identifier with user-invoked web search requests. The disclosure is limited to the Codex request path, so this is a telemetry warning rather than evidence of a broader attack.
Evidence
dist/activation.js
Network endpoints1
chatgpt.com/backend-api
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The User-Agent reads TERM_PROGRAM or TERM from the environment and appends that value to the request metadata.
- The value is included in headers for the POST that performs a web search.
Evidence against
- The request is made by the web search tool’s execute path, rather than during installation or module import.
- The default endpoint is the ChatGPT Codex service, and the README says the User-Agent identifies the runtime.
Behavioral surface
EnvironmentVarsNetwork
UrlStrings
Source & flagged code
3 flaggeddist/activation.jsView file
312var OPENAI_CODEX_PROVIDER = "openai-codex";
L313: var DEFAULT_CODEX_BASE_URL = "https://chatgpt.com/backend-api";
L314:
...
L332: function codexWebRunUserAgent(originator = CODEX_TOOL_ORIGINATOR) {
L333: const platform = process.platform === "darwin" ? "Mac OS" : process.platform === "win32" ? "Windows" : process.platform === "linux" ? "Linux" : process.platform;
L334: const arch = process.arch === "arm64" ? "arm64" : process.arch;
L335: const terminal = process.env["TERM_PROGRAM"]?.trim() || process.env["TERM"]?.trim() || "unknown";
L336: return originator + "/0.0.0 (" + platform + " unknown; " + arch + ") " + terminal;
...
L491: const reader = response.body.getReader();
L492: const decoder = new TextDecoder;
L493: let total = 0;
...
L676: headers: codexToolProviderHeaders(provider
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/activation.jsView on unpkg · L312333process.platform === "darwin" ? "Mac OS" : process.platform === "win32" ? "Windows" : process.platform === "linux" ? "Linux" : process.platform;
const arch = process.arch === "arm64" ? "arm64" : process.arch;
const terminal = process.env["TERM_PROGRAM"]?.trim() || process.env["TERM"]?.trim() || "unknown";
return originator + "/0.0.0 (" + platform + " unknown; " + arch + ") " + terminal;
}
// internal/codex/htt
Medium
Ai Review Evidence
The User-Agent reads TERM_PROGRAM or TERM from the environment and appends that value to the request metadata.
Findings
1 High4 Medium1 Low
HighSandbox Evasion Gated Capabilitydist/activation.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencedist/activation.js
MediumAi Review Evidencedist/activation.js
LowUrl Strings
Affected versions and remediation
This report applies to @howaboua/pi-durable-web@0.10.0.
See all versions of @howaboua/pi-durable-web for other recorded verdicts.
- Review the evidence and your use of @howaboua/pi-durable-web@0.10.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.