registry / @maxiaochao/pi-toolkit / 0.10.23

@maxiaochao/pi-toolkit@0.10.23

Personal pi coding agent toolkit: scheduler, /btw, /cache_export, apply_patch, browser automation, and bundled theme/skills.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The postinstall mutates the package’s own Pi agent configuration and installs its own CLI, which warrants a warning under the agent extension lifecycle policy. Inspected evidence does not establish a concrete attack or malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through npm runs its postinstall hook.

Impact

The package can change instructions and settings used by the user’s Pi agent and add its own CLI to local user directories.

Mechanism

The hook copies the bundled AGENTS.md into the user’s Pi agent directory, may initialize the default theme setting, and installs the package’s pi-worktree command and completion files.

AI rationale

Evidence

package.jsonscripts/install-agents.mjsglobal/AGENTS.mdpackages/worktree/scripts/install.mjs

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package postinstall hook runs scripts/install-agents.mjs automatically.
That script synchronizes the package’s bundled AGENTS.md into the Pi agent directory and may initialize settings.
The postinstall also installs the package’s pi-worktree command and shell completion files under the user’s local directory.

Evidence against

The inspected setup is limited to this package’s Pi agent files and its own CLI; no credential forwarding, unrelated approval changes, or remote payload execution was identified.
The flagged browser and benchmark files show browser-test setup and explicitly supplied benchmark commands, not install-time behavior.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

12 flagged

package.jsonView file

Lines 45-71json

45 "./themes"

46 ]

47 },

48 "bin": {

49 "pi-worktree": "packages/worktree/bin/pi-worktree"

50 },

51 "peerDependencies": {

52 "@earendil-works/pi-ai": "*",

53 "@earendil-works/pi-coding-agent": "*",

54 "@earendil-works/pi-tui": "*",

55 "typebox": "*"

56 },

57 "dependencies": {

58 "ws": "^8.19.0"

59 },

60 "scripts": {

61 "test": "node tests/package-layout.mjs && npm --prefix packages/todo test && npm --prefix packages/cache-export test && npm --prefix packages/codex-edit test && npm --prefix packages/herdr-subagents test && npm --prefix packages/scheduler test && npm --prefix packages/worktree test && node --experimental-strip-types extensions/btw/tests/history.mjs",

62 "load-test": "pi -ne -e ./packages/cache-export/extensions/cache-export.ts && pi -ne -e ./extensions/btw/index.ts && pi -ne -e ./packages/codex-edit/extensions/codex-edit.ts && pi -ne -e ./packages/herdr-subagents/extensions/herdr-subagents.ts && pi -ne -e ./packages/scheduler/extensions/scheduler.ts && pi -ne -e ./packages/worktree/extensions/worktree.ts",

63 "eval:agents": "node evaluations/agents-md/run.mjs",

64 "eval:agents:test": "node evaluations/agents-md/tests/run-tests.mjs",

65 "postinstall": "node scripts/install-agents.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L65

66 },

67 "publishConfig": {

68 "access": "public"

69 }

70}

packages/worktree/tests/extension.test.mjsView file

57L58: const extension = (await import(`${extensionUrl}?test=${Math.random()}`)).default; L59: extension(pi);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packages/worktree/tests/extension.test.mjsView on unpkg · L57

scripts/install-agents.mjsView file

Lines 1-21javascript

1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme

2// without overriding a theme the user has already selected.

3import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";

4import { homedir } from "node:os";

5import { dirname, join } from "node:path";

skills/pdlog/tools/ppmdView file

•path = skills/pdlog/tools/ppmd kind = native_binary sizeBytes = 68456 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

skills/pdlog/tools/ppmdView on unpkg

packages/worktree/bin/pi-worktree-completion.bashView file

•path = packages/worktree/bin/pi-worktree-completion.bash kind = build_helper sizeBytes = 1384 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/worktree/bin/pi-worktree-completion.bashView on unpkg

packages/worktree/tests/run-tests.shView file

•path = packages/worktree/tests/run-tests.sh kind = payload_in_excluded_dir sizeBytes = 4742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

packages/worktree/tests/run-tests.shView on unpkg

packages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1View on unpkg

skills/web-browser/scripts/start.jsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.9.3 matchedPath = skills/web-browser/scripts/start.js matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.9.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High