registry / AI-agent control-surface risk / @maxiaochao/pi-toolkit
@maxiaochao/pi-toolkit
Personal pi coding agent toolkit: background tasks, scheduler, /btw, /cache_export, apply_patch, browser automation, and bundled theme/skills.
This report shows the evidence for @maxiaochao/pi-toolkit@0.13.4. 23 of 61 known versions are blocked or flagged. The newest version, 0.13.5, is flagged. See all versions.
AI Security Review
scanned 20h ago · by lpm-firewall-aiThe postinstall hook performs an unconsented write to a global AI-agent control surface and replaces differing user instructions. This supports blocking despite the package documenting the feature and bundling ordinary guidance.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package through npm runs its postinstall hook.
Impact
Global agent instructions are changed without a specific user opt-in, potentially overriding customized guidance.
Mechanism
The hook copies bundled instructions into ~/.pi/agent/AGENTS.md without asking for confirmation.
Policy narrative
On npm installation, postinstall invokes the installer, which copies the package's global agent instructions into the user's Pi agent directory whenever the existing file differs. The write has no confirmation or opt-in guard, so it can replace customized instructions used across projects. The bundled text is generic coding guidance, but that does not establish consent for the global change.
AI rationale
The postinstall hook performs an unconsented write to a global AI-agent control surface and replaces differing user instructions. This supports blocking despite the package documenting the feature and bundling ordinary guidance.
Evidence
package.jsonscripts/install-agents.mjsglobal/AGENTS.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 95.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs scripts/install-agents.mjs automatically through postinstall.
- The installer targets ~/.pi/agent/AGENTS.md and loads the bundled global/AGENTS.md.
- When the target differs, the installer writes the bundled instructions over it without a consent check.
- The bundled file contains behavioral guidelines for the Pi agent.
- The README confirms this global instruction sync is part of postinstall.
Evidence against
- The README describes the sync as an intended feature, and the bundled file contains generic coding guidance.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
14 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-agents.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackages/worktree/tests/extension.test.mjsView file
57L58: const extension = (await import(`${extensionUrl}?test=${Math.random()}`)).default;
L59: extension(pi);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
packages/worktree/tests/extension.test.mjsView on unpkg · L57scripts/install-agents.mjsView file
1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme
L2: // without overriding a theme the user has already selected.
L3: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
L4: import { homedir } from "node:os";
...
L11: const agentDir = join(homedir(), ".pi", "agent");
L12: const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8");
L13: const agentsTarget = join(agentDir, "AGENTS.md");
L14: const settingsTarget = join(agentDir, "settings.json");
...
L16: if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) {
L17: mkdirSync(dirname(agentsTarget), { recursive: true });
L18: writeFileSync(agentsTarget, bundled, "utf8");
L19: console.log("[pi-toolkit]
Findings
1 Critical10 High6 Medium4 Low
CriticalAi Agent Control Hijackscripts/install-agents.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighPayload In Excluded Dirpackages/background-tasks/tests/tui-smoke.py
HighSemantic Analysis Limitedpackages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1
HighKnown Malware Source Similarityskills/web-browser/scripts/start.js
HighKnown Malware Source Similaritypackages/cache-export/tests/e2e-browser.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/run-with-budget.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/select-tasks.mjs
HighKnown Malware Source Similaritypackages/herdr-subagents/extensions/subagent-report.ts
Affected versions and remediation
This report applies to @maxiaochao/pi-toolkit@0.13.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing @maxiaochao/pi-toolkit@0.13.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
61 known versions0.13.5latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 22, 2026, 5:06 AM0.13.4shownMaliciousSoft block: AI-agent control surfaceBlockPublishedOct 22, 2026, 4:59 AM0.13.3SuspiciousAgent extension lifecycle riskWarnPublishedOct 21, 2026, 12:30 PM0.13.0SuspiciousAI-agent capability abuseWarn