registry / @maxiaochao/pi-toolkit / 0.10.11

@maxiaochao/pi-toolkit@0.10.11

Personal pi coding agent toolkit: scheduler, /btw, /cache_export, apply_patch, browser automation, and bundled theme/skills.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The automatic postinstall write to global agent instructions creates a real agent configuration lifecycle risk. The inspected content is ordinary coding guidance and does not establish malicious behavior, so this warrants a warning rather than a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the npm package, which runs its postinstall hook.

Impact

Global Pi agent instructions can change during package installation without a separate confirmation.

Mechanism

The hook syncs the bundled AGENTS.md into ~/.pi/agent/AGENTS.md when the existing file is missing or differs, and also sets a default theme when needed.

AI rationale

Evidence

package.jsonscripts/install-agents.mjsglobal/AGENTS.mdpackages/worktree/scripts/install.mjs~/.pi/agent/AGENTS.md~/.pi/agent/settings.json~/.local/bin/pi-worktree~/.local/share/bash-completion/completions/pi-worktree

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The postinstall hook automatically runs the package’s agent installer.
The installer writes the bundled AGENTS.md to ~/.pi/agent/AGENTS.md when that file differs, with no separate consent check.
The bundled file contains general coding guidance, and the settings logic preserves a nonempty chosen theme; this bounds the concern to automatic agent setup.
The same hook installs a package-owned pi-worktree command and shell completion files.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 81 file(s), 677 KB of source, external domains: 127.0.0.1, example.com, github.com

Source & flagged code

14 flagged

package.jsonView file

Lines 45-71json

45 "./themes"

46 ]

47 },

48 "bin": {

49 "pi-worktree": "packages/worktree/bin/pi-worktree"

50 },

51 "peerDependencies": {

52 "@earendil-works/pi-ai": "*",

53 "@earendil-works/pi-coding-agent": "*",

54 "@earendil-works/pi-tui": "*",

55 "typebox": "*"

56 },

57 "dependencies": {

58 "ws": "^8.19.0"

59 },

60 "scripts": {

61 "test": "node tests/package-layout.mjs && npm --prefix packages/todo test && npm --prefix packages/cache-export test && npm --prefix packages/codex-edit test && npm --prefix packages/herdr-subagents test && npm --prefix packages/scheduler test && npm --prefix packages/worktree test && node --experimental-strip-types extensions/btw/tests/history.mjs",

62 "load-test": "pi -ne -e ./packages/cache-export/extensions/cache-export.ts && pi -ne -e ./extensions/btw/index.ts && pi -ne -e ./packages/codex-edit/extensions/codex-edit.ts && pi -ne -e ./packages/herdr-subagents/extensions/herdr-subagents.ts && pi -ne -e ./packages/scheduler/extensions/scheduler.ts && pi -ne -e ./packages/worktree/extensions/worktree.ts",

63 "eval:agents": "node evaluations/agents-md/run.mjs",

64 "eval:agents:test": "node evaluations/agents-md/tests/run-tests.mjs",

65 "postinstall": "node scripts/install-agents.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L65

66 },

67 "publishConfig": {

68 "access": "public"

69 }

70}

scripts/install-agents.mjsView file

Lines 1-21javascript

1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme

2// without overriding a theme the user has already selected.

3import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";

4import { homedir } from "node:os";

5import { dirname, join } from "node:path";

skills/pdlog/tools/ppmdView file

•path = skills/pdlog/tools/ppmd kind = native_binary sizeBytes = 68456 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

skills/pdlog/tools/ppmdView on unpkg

packages/worktree/bin/pi-worktree-completion.bashView file

•path = packages/worktree/bin/pi-worktree-completion.bash kind = build_helper sizeBytes = 1384 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/worktree/bin/pi-worktree-completion.bashView on unpkg

packages/worktree/tests/run-tests.shView file

•path = packages/worktree/tests/run-tests.sh kind = payload_in_excluded_dir sizeBytes = 4742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

packages/worktree/tests/run-tests.shView on unpkg

packages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1View on unpkg

skills/web-browser/scripts/start.jsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.11.5 matchedPath = skills/web-browser/scripts/start.js matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.11.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/web-browser/scripts/start.jsView on unpkg

packages/cache-export/tests/e2e-browser.mjsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.11.5 matchedPath = packages/cache-export/tests/e2e-browser.mjs matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.11.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cache-export/tests/e2e-browser.mjsView on unpkg

packages/codex-edit/benchmark/run-with-budget.mjsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.11.5 matchedPath = packages/codex-edit/benchmark/run-with-budget.mjs matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.11.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/codex-edit/benchmark/run-with-budget.mjsView on unpkg

packages/codex-edit/benchmark/select-tasks.mjsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.11.5 matchedPath = packages/codex-edit/benchmark/select-tasks.mjs matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.11.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/codex-edit/benchmark/select-tasks.mjsView on unpkg

packages/codex-edit/tests/generate-test-report.mjsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.11.5 matchedPath = packages/codex-edit/tests/generate-test-report.mjs matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.11.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/codex-edit/tests/generate-test-report.mjsView on unpkg

packages/herdr-subagents/src/herdr.tsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.10.14 matchedPath = packages/herdr-subagents/src/herdr.ts matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.10.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/herdr-subagents/src/herdr.tsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @maxiaochao/pi-toolkit@0.11.7 matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.11.7 similarity = 0.612 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/herdr-subagents/src/herdr.tsView on unpkg

packages/herdr-subagents/extensions/subagent-report.tsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.10.14 matchedPath = packages/herdr-subagents/extensions/subagent-report.ts matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.10.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/herdr-subagents/extensions/subagent-report.tsView on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-agents.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/install-agents.mjsView file

1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme L2: // without overriding a theme the user has already selected. L3: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs"; L4: import { homedir } from "node:os"; ... L11: const agentDir = join(homedir(), ".pi", "agent"); L12: const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8"); L13: const agentsTarget = join(agentDir, "AGENTS.md"); L14: const settingsTarget = join(agentDir, "settings.json"); ... L16: if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) { L17: mkdirSync(dirname(agentsTarget), { recursive: true }); L18: writeFileSync(agentsTarget, bundled, "utf8"); L19: console.log("[pi-toolkit]

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-agents.mjsView on unpkg · L1

Findings

1 Critical11 High5 Medium5 Low

CriticalAi Agent Control Hijackscripts/install-agents.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dirpackages/worktree/tests/run-tests.sh

HighSemantic Analysis Limitedpackages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1

HighKnown Malware Source Similarityskills/web-browser/scripts/start.js

HighKnown Malware Source Similaritypackages/cache-export/tests/e2e-browser.mjs

HighKnown Malware Source Similaritypackages/codex-edit/benchmark/run-with-budget.mjs

HighKnown Malware Source Similaritypackages/codex-edit/benchmark/select-tasks.mjs

HighKnown Malware Source Similaritypackages/codex-edit/tests/generate-test-report.mjs

Affected versions and remediation

This report applies to @maxiaochao/pi-toolkit@0.10.11.

See all versions of @maxiaochao/pi-toolkit for other recorded verdicts.

Review the evidence and your use of @maxiaochao/pi-toolkit@0.10.11 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-13 22:47:18.698Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.