registry / @maxiaochao/pi-toolkit / 0.10.6
@maxiaochao/pi-toolkit@0.10.6
Personal pi coding agent toolkit: /btw, /cache_export and apply_patch extensions, browser automation, and bundled theme/skills.
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe postinstall hook automatically changes first-party agent configuration and installs a helper, which warrants a warning under the agent extension lifecycle policy. Inspected source supports setup behavior but not a concrete attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Installing the package runs its postinstall hook.
Impact
The installation changes user-level agent configuration and adds a command-line helper.
Mechanism
The hook syncs bundled global agent instructions, sets a default theme when needed, and installs a package-owned command and completion files in the user’s home directory.
AI rationale
The postinstall hook automatically changes first-party agent configuration and installs a helper, which warrants a warning under the agent extension lifecycle policy. Inspected source supports setup behavior but not a concrete attack.
Evidence
package.jsonscripts/install-agents.mjspackages/worktree/scripts/install.mjs~/.pi/agent/AGENTS.md~/.pi/agent/settings.json~/.local/bin/pi-worktree~/.local/share/bash-completion/completions/pi-worktree
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package postinstall hook runs the agent setup script automatically.
- That script can replace the global agent instructions file and initialize the agent settings file.
- The same hook installs a package-owned command and shell completion under the user’s home directory.
- The bundled instructions are general coding guidance; no malicious behavior was established in the inspected excerpts.
Evidence against
- The inspected setup code showed no credential collection, network transmission, or remote payload execution.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
17 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-agents.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackages/herdr-subagents/src/herdr.tsView file
1import { spawn } from "node:child_process";
L2:
High
Child Process
Package source references child process execution.
packages/herdr-subagents/src/herdr.tsView on unpkg · L1•matchType = normalized_sha256
matchedPackage = @maxiaochao/pi-toolkit@0.10.5
matchedPath = packages/herdr-subagents/src/herdr.ts
matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.10.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
Findings
1 Critical14 High5 Medium5 Low
CriticalAi Agent Control Hijackscripts/install-agents.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processpackages/herdr-subagents/src/herdr.ts
HighShellskills/web-browser/scripts/start.js
HighSame File Env Network Executionskills/chrome-cdp/scripts/cdp.mjs
HighPayload In Excluded Dirpackages/worktree/tests/run-tests.sh
HighSemantic Analysis Limitedpackages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1
HighKnown Malware Source Similarityskills/chrome-cdp/scripts/cdp.mjs
HighKnown Malware Source Similarityskills/web-browser/scripts/start.js
HighKnown Malware Source Similaritypackages/cache-export/tests/e2e-browser.mjs
Affected versions and remediation
This report applies to @maxiaochao/pi-toolkit@0.10.6.
See all versions of @maxiaochao/pi-toolkit for other recorded verdicts.
- Review the evidence and your use of @maxiaochao/pi-toolkit@0.10.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.