@maxiaochao/pi-toolkit@0.1.7: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@maxiaochao/pi-toolkit@0.1.7: AI-agent control-surface risk | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-agents.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

40"postinstall": "node scripts/install-agents.mjs" }, "publish

High

Ai Review Evidence

package.json automatically runs scripts/install-agents.mjs after installation.

package.jsonView on unpkg · L40

scripts/install-agents.mjsView file

1// postinstall hook: sync the bundled global AGENTS.md to ~/.pi/agent/AGENTS.md L2: // (pi's native global context file). Idempotent: writes only when different. L3: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs"; L4: import { homedir } from "node:os"; ... L7: L8: const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8"); L9: const target = join(homedir(), ".pi", "agent", "AGENTS.md"); L10: L11: if (!existsSync(target) || readFileSync(target, "utf8") !== bundled) { L12: mkdirSync(dirname(target), { recursive: true }); L13: writeFileSync(target, bundled, "utf8"); L14: console.log("[pi-toolkit] global AGENTS.md synced ->", target);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-agents.mjsView on unpkg · L1

9const target = join(homedir(), ".pi", "agent", "AGENTS.md"); if (!existsSync(target) || readFileSync(target, "utf8") !== bundled) { mkdirSync(dirname(target), { recursive: true }); writeFileSync(target, bundled, "utf8"); console.log("[pi-toolkit] global AGENTS.md synced ->"

High

Ai Review Evidence

scripts/install-agents.mjs creates or overwrites ~/.pi/agent/AGENTS.md with bundled instructions whenever its contents differ, without consent or backup.

scripts/install-agents.mjsView on unpkg · L9

extensions/cache-export/index.tsView file

•matchType = malicious_source_fingerprint_signature signature = 34063359ecd19f6f signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @maxiaochao/pi-toolkit@0.1.5 matchedPath = extensions/cache-export/index.ts matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.1.5 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

extensions/cache-export/index.tsView on unpkg

global/AGENTS.mdView file

34When editing existing code: - Don't "improve" adjacent code, comments, or formatting. - Don't refactor things that aren't broken. - Match existing style, even if you'd do it differently. - If you no

High

Ai Review Evidence

global/AGENTS.md supplies coding behavior instructions for the global agent context.

global/AGENTS.mdView on unpkg · L34

Source & flagged code

6 flagged

package.jsonView file

Lines 20-46json

20 "url": "git+https://github.com/chaochaoxiaochao/pi-toolkit.git"

21 },

22 "pi": {

23 "extensions": [

24 "./extensions/todo.ts",

25 "./extensions/cache-export/index.ts"

26 ],

27 "skills": [

28 "./skills"

29 ]

30 },

31 "peerDependencies": {

32 "@earendil-works/pi-ai": "*",

33 "@earendil-works/pi-coding-agent": "*",

34 "@earendil-works/pi-tui": "*",

35 "typebox": "*"

36 },

37 "scripts": {

38 "test": "cd extensions/cache-export && node --experimental-strip-types tests/run-tests.mjs",

39 "load-test": "pi -ne -e ./extensions/todo.ts && pi -ne -e ./extensions/cache-export/index.ts",

40 "postinstall": "node scripts/install-agents.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

41 },

42 "publishConfig": {

High

Ai Review Evidence

package.json automatically runs scripts/install-agents.mjs after installation.

package.jsonView on unpkg · L40

43 "access": "public"

44 }

45}

46

scripts/install-agents.mjsView file

Lines 1-16javascript

1// postinstall hook: sync the bundled global AGENTS.md to ~/.pi/agent/AGENTS.md

2// (pi's native global context file). Idempotent: writes only when different.

3import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";

4import { homedir } from "node:os";

5import { dirname, join } from "node:path";

extensions/cache-export/index.tsView file

•matchType = malicious_source_fingerprint_signature signature = 34063359ecd19f6f signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @maxiaochao/pi-toolkit@0.1.5 matchedPath = extensions/cache-export/index.ts matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.1.5 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

extensions/cache-export/index.tsView on unpkg

global/AGENTS.mdView file

Lines 14-54markdown

14- If a simpler approach exists, say so. Push back when warranted.

15- If something is unclear, stop. Name what's confusing. Ask.

16- If requirements conflict (e.g., durability vs latency, correctness vs speed), name the conflict explicitly. Never average conflicting requirements into something that satisfies neither.

17

18## 2. Simplicity First

19

20**Minimum code that solves the problem. Nothing speculative.**

21

22- No features beyond what was asked.

23-