registry / @ilya-lesikov/pi-pi / 0.6.0

@ilya-lesikov/pi-pi@0.6.0

Pi-Pi Coding Agent: based on Pi Coding Agent, but twice as good

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 280 file(s), 2.54 MB of source, external domains: 127.0.0.1, cli.github.com, en.wikipedia.org, example.com, ghe.company.com, git.internal.corp, github.com, gitlab.com, gitlab.example.com, llm-api.flant.ru, mcp.exa.ai, openrouter.ai, plannotator-paste.plannotator.workers.dev, plannotator.ai, r.jina.ai, share.plannotator.ai, www.w3.org

Source & flagged code

3 flagged

package.jsonView file

Lines 16-56json

16 "files": [

17 "extensions/",

18 "3p/pi-subagents/src/",

19 "3p/pi-subagents/package.json",

20 "3p/pi-tasks/src/",

21 "3p/pi-tasks/package.json",

22 "3p/pi-lsp/extensions/",

23 "3p/pi-lsp/package.json",

24 "3p/pi-ask-user/index.ts",

25 "3p/pi-ask-user/single-select-layout.ts",

26 "3p/pi-ask-user/package.json",

27 "3p/pi-plannotator/apps/pi-extension/",

28 "3p/pi-plannotator/packages/shared/",

29 "3p/pi-plannotator/packages/server/",

30 "3p/pi-plannotator/packages/ai/",

31 "3p/pi-plannotator/package.json",

32 "scripts/",

33 "AGENTS.md"

34 ],

35 "scripts": {

36 "postinstall": "bash scripts/postinstall.sh",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 "test": "vitest run --exclude '3p/**'",

38 "test:watch": "vitest --exclude '3p/**'"

39 },

40 "pi": {

41 "extensions": [

42 "./extensions/orchestrator",

43 "./3p/pi-subagents/src/index.ts",

44 "./3p/pi-tasks/src/index.ts",

45 "./3p/pi-lsp/extensions/lsp",

46 "./3p/pi-ask-user",

47 "./3p/pi-plannotator/apps/pi-extension"

48 ]

49 },

50 "dependencies": {

51 "@joplin/turndown-plugin-gfm": "^1.0.64",

52 "@pierre/diffs": "^1.2.0",

53 "effect": "^3.0.0",

54 "minimatch": "^10.0.0",

55 "pino": "^10.3.1",

56 "proper-lockfile": "^4.1.2",

3p/pi-plannotator/apps/pi-extension/vendor.shView file

•path = 3p/pi-plannotator/apps/pi-extension/vendor.sh kind = build_helper sizeBytes = 2751 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

3p/pi-plannotator/apps/pi-extension/vendor.shView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = bash scripts/postinstall.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bash scripts/postinstall.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

3p/pi-plannotator/apps/pi-extension/vendor.shView file

•path = 3p/pi-plannotator/apps/pi-extension/vendor.sh kind = build_helper sizeBytes = 2751 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

3p/pi-plannotator/apps/pi-extension/vendor.shView on unpkg

Findings

1 High5 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helper3p/pi-plannotator/apps/pi-extension/vendor.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

package.jsonView file

Lines 16-56json

16 "files": [

17 "extensions/",

18 "3p/pi-subagents/src/",

19 "3p/pi-subagents/package.json",

20 "3p/pi-tasks/src/",

21 "3p/pi-tasks/package.json",

22 "3p/pi-lsp/extensions/",

23 "3p/pi-lsp/package.json",

24 "3p/pi-ask-user/index.ts",

25 "3p/pi-ask-user/single-select-layout.ts",

26 "3p/pi-ask-user/package.json",

27 "3p/pi-plannotator/apps/pi-extension/",

28 "3p/pi-plannotator/packages/shared/",

29 "3p/pi-plannotator/packages/server/",

30 "3p/pi-plannotator/packages/ai/",

31 "3p/pi-plannotator/package.json",

32 "scripts/",

33 "AGENTS.md"

34 ],

35 "scripts": {

36 "postinstall": "bash scripts/postinstall.sh",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 "test": "vitest run --exclude '3p/**'",

38 "test:watch": "vitest --exclude '3p/**'"

39 },

40 "pi": {

41 "extensions": [

42 "./extensions/orchestrator",

43 "./3p/pi-subagents/src/index.ts",

44 "./3p/pi-tasks/src/index.ts",

45 "./3p/pi-lsp/extensions/lsp",

46 "./3p/pi-ask-user",

47 "./3p/pi-plannotator/apps/pi-extension"

48 ]

49 },

50 "dependencies": {

51 "@joplin/turndown-plugin-gfm": "^1.0.64",

52 "@pierre/diffs": "^1.2.0",

53 "effect": "^3.0.0",

54 "minimatch": "^10.0.0",

55 "pino": "^10.3.1",

56 "proper-lockfile": "^4.1.2",

3p/pi-plannotator/apps/pi-extension/vendor.shView file

•path = 3p/pi-plannotator/apps/pi-extension/vendor.sh kind = build_helper sizeBytes = 2751 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

3p/pi-plannotator/apps/pi-extension/vendor.shView on unpkg