@maxiaochao/pi-toolkit@0.10.13
Personal pi coding agent toolkit: scheduler, /btw, /cache_export, apply_patch, browser automation, and bundled theme/skills.
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe postinstall hook makes an unprompted global agent instruction change, which is a concrete control-surface mutation. The bundled text appears benign and no network activity is established in this install path, but the automatic global overwrite warrants blocking under the install control-surface policy.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm installation invokes the package postinstall hook.
Impact
This changes instructions used by the global Pi agent without a separate user command; customized instructions can be replaced.
Mechanism
The hook writes the bundled AGENTS.md to ~/.pi/agent/AGENTS.md when it differs, then installs pi-worktree and shell completion files under the user's home directory.
Policy narrative
Installation automatically replaces differing global Pi agent instructions with the package's bundled AGENTS.md. The file contains general coding guidance, but the postinstall hook changes the user's global agent control file without a separate setup command. The hook also installs a package-provided CLI and completion file under the user's home directory.
AI rationale
The postinstall hook makes an unprompted global agent instruction change, which is a concrete control-surface mutation. The bundled text appears benign and no network activity is established in this install path, but the automatic global overwrite warrants blocking under the install control-surface policy.
Evidence
package.jsonscripts/install-agents.mjsglobal/AGENTS.mdpackages/worktree/scripts/install.mjs~/.pi/agent/AGENTS.md~/.pi/agent/settings.json~/.local/bin/pi-worktree~/.local/share/bash-completion/completions/pi-worktree
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs scripts/install-agents.mjs automatically after installation.
- The hook replaces the user's global Pi AGENTS.md with the bundled file whenever they differ.
- The bundled file supplies instructions to the global Pi agent, making the postinstall write a change to an agent control surface.
- The same hook installs a pi-worktree executable under the user's home directory.
- The code shows no network behavior in this install path.
Evidence against
- The bundled agent instructions are general coding guidelines, not an apparent payload.
- The worktree installer copies a package-provided CLI and shell completion file.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
14 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-agents.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackages/worktree/tests/extension.test.mjsView file
57L58: const extension = (await import(`${extensionUrl}?test=${Math.random()}`)).default;
L59: extension(pi);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
packages/worktree/tests/extension.test.mjsView on unpkg · L57scripts/install-agents.mjsView file
1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme
L2: // without overriding a theme the user has already selected.
L3: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
L4: import { homedir } from "node:os";
...
L11: const agentDir = join(homedir(), ".pi", "agent");
L12: const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8");
L13: const agentsTarget = join(agentDir, "AGENTS.md");
L14: const settingsTarget = join(agentDir, "settings.json");
...
L16: if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) {
L17: mkdirSync(dirname(agentsTarget), { recursive: true });
L18: writeFileSync(agentsTarget, bundled, "utf8");
L19: console.log("[pi-toolkit]
Findings
1 Critical10 High6 Medium5 Low
CriticalAi Agent Control Hijackscripts/install-agents.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighPayload In Excluded Dirpackages/worktree/tests/run-tests.sh
HighSemantic Analysis Limitedpackages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1
HighKnown Malware Source Similarityskills/web-browser/scripts/start.js
HighKnown Malware Source Similaritypackages/cache-export/tests/e2e-browser.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/run-with-budget.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/select-tasks.mjs
HighKnown Malware Source Similaritypackages/codex-edit/tests/generate-test-report.mjs
Affected versions and remediation
This report applies to @maxiaochao/pi-toolkit@0.10.13.
See all versions of @maxiaochao/pi-toolkit for other recorded verdicts.
- Avoid installing @maxiaochao/pi-toolkit@0.10.13. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.