registry / @maxiaochao/pi-toolkit / 0.10.8

@maxiaochao/pi-toolkit@0.10.8

Personal pi coding agent toolkit: scheduler, /btw, /cache_export, apply_patch, browser automation, and bundled theme/skills.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The postinstall performs guarded setup for the package's own Pi agent integration, but it also automatically writes global agent instructions and user-level command files. This merits a warning under the agent extension lifecycle policy; the inspected source does not establish a concrete attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall

Impact

This changes global agent instructions and user-level command configuration without a separate setup command; source inspection did not establish credential access or remote activity.

Mechanism

The hook copies bundled AGENTS.md into ~/.pi/agent when it is missing or differs, sets a default theme when needed, and installs pi-worktree under ~/.local.

AI rationale

Evidence

package.jsonscripts/install-agents.mjspackages/worktree/scripts/install.mjs

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs an automatic postinstall that invokes its agent setup script.
The setup script writes the bundled instructions to the user's global Pi agent directory and may replace a differing AGENTS.md.
The setup script initializes a default theme and installs the package's pi-worktree command and completion files under the user's home directory.

Evidence against

The configuration writes target the package's own Pi agent integration and bundled theme; the inspected installer shows no network transfer.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 82 file(s), 708 KB of source, external domains: 127.0.0.1, example.com, github.com

Source & flagged code

18 flagged

package.jsonView file

Lines 45-71json

45 "./themes"

46 ]

47 },

48 "bin": {

49 "pi-worktree": "packages/worktree/bin/pi-worktree"

50 },

51 "peerDependencies": {

52 "@earendil-works/pi-ai": "*",

53 "@earendil-works/pi-coding-agent": "*",

54 "@earendil-works/pi-tui": "*",

55 "typebox": "*"

56 },

57 "dependencies": {

58 "ws": "^8.19.0"

59 },

60 "scripts": {

61 "test": "node tests/package-layout.mjs && npm --prefix packages/todo test && npm --prefix packages/cache-export test && npm --prefix packages/codex-edit test && npm --prefix packages/herdr-subagents test && npm --prefix packages/scheduler test && npm --prefix packages/worktree test && node --experimental-strip-types extensions/btw/tests/history.mjs",

62 "load-test": "pi -ne -e ./packages/cache-export/extensions/cache-export.ts && pi -ne -e ./extensions/btw/index.ts && pi -ne -e ./packages/codex-edit/extensions/codex-edit.ts && pi -ne -e ./packages/herdr-subagents/extensions/herdr-subagents.ts && pi -ne -e ./packages/scheduler/extensions/scheduler.ts && pi -ne -e ./packages/worktree/extensions/worktree.ts",

63 "eval:agents": "node evaluations/agents-md/run.mjs",

64 "eval:agents:test": "node evaluations/agents-md/tests/run-tests.mjs",

65 "postinstall": "node scripts/install-agents.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L65

66 },

67 "publishConfig": {

68 "access": "public"

69 }

70}

packages/herdr-subagents/src/herdr.tsView file

Lines 1-21typescript

1import { spawn } from "node:child_process";

High

Child Process

Package source references child process execution.

packages/herdr-subagents/src/herdr.tsView on unpkg · L1

3export interface CreateTabRequest {

4 workspaceId: string;

skills/web-browser/scripts/start.jsView file

Lines 41-81javascript

42const HOME = process.env["HOME"] || homedir();

43const CACHE_ROOT = join(HOME, ".cache", "agent-web"

skills/chrome-cdp/scripts/cdp.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2// cdp - lightweight Chrome DevTools Protocol CLI

3// Uses raw CDP over WebSocket, no Puppeteer dependency.

4// Requires Node 22+ (built-in WebSocket).

5//

6// Per-tab persistent daemon: page commands go through a daemon that holds

7// the CDP session open. Chrome's "Allow debugging" modal fires once per

8// daemon (= once per tab). Daemons auto-exit after 20min idle.

10import { readFileSync, writeFileSync, unlinkSync, existsSync, mkdirSync }

scripts/install-agents.mjsView file

Lines 1-21javascript

1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme

2// without overriding a theme the user has already selected.

3import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";

4import { homedir } from "node:os";

5import { dirname, join } from "node:path";

skills/pdlog/tools/ppmdView file

•path = skills/pdlog/tools/ppmd kind = native_binary sizeBytes = 68456 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

skills/pdlog/tools/ppmdView on unpkg

packages/worktree/bin/pi-worktree-completion.bashView file

•path = packages/worktree/bin/pi-worktree-completion.bash kind = build_helper sizeBytes = 1384 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/worktree/bin/pi-worktree-completion.bashView on unpkg

packages/worktree/tests/run-tests.shView file

•path = packages/worktree/tests/run-tests.sh kind = payload_in_excluded_dir sizeBytes = 4742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

packages/worktree/tests/run-tests.shView on unpkg

packages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1View on unpkg

packages/cache-export/tests/e2e-browser.mjsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.10.5 matchedPath = packages/cache-export/tests/e2e-browser.mjs matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.10.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cache-export/tests/e2e-browser.mjsView on unpkg

packages/codex-edit/benchmark/run-with-budget.mjsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.10.5 matchedPath = packages/codex-edit/benchmark/run-with-budget.mjs matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.10.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/codex-edit/benchmark/run-with-budget.mjsView on unpkg

packages/codex-edit/benchmark/select-tasks.mjsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.10.5 matchedPath = packages/codex-edit/benchmark/select-tasks.mjs matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.10.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/codex-edit/benchmark/select-tasks.mjsView on unpkg

packages/codex-edit/tests/generate-test-report.mjsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.10.5 matchedPath = packages/codex-edit/tests/generate-test-report.mjs matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.10.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/codex-edit/tests/generate-test-report.mjsView on unpkg

packages/herdr-subagents/extensions/subagent-report.tsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.10.5 matchedPath = packages/herdr-subagents/extensions/subagent-report.ts matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.10.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/herdr-subagents/extensions/subagent-report.tsView on unpkg

packages/worktree/extensions/worktree.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @maxiaochao/pi-toolkit@0.10.7 matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.10.7 similarity = 0.869 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/worktree/extensions/worktree.tsView on unpkg

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-agents.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

packages/herdr-subagents/src/herdr.tsView file

1import { spawn } from "node:child_process"; L2:

High

Child Process

Package source references child process execution.

packages/herdr-subagents/src/herdr.tsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.10.5 matchedPath = packages/herdr-subagents/src/herdr.ts matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.10.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

Findings

1 Critical15 High5 Medium5 Low

CriticalAi Agent Control Hijackscripts/install-agents.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processpackages/herdr-subagents/src/herdr.ts

HighShellskills/web-browser/scripts/start.js

HighSame File Env Network Executionskills/chrome-cdp/scripts/cdp.mjs

HighPayload In Excluded Dirpackages/worktree/tests/run-tests.sh

HighSemantic Analysis Limitedpackages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1

HighKnown Malware Source Similarityskills/chrome-cdp/scripts/cdp.mjs

HighKnown Malware Source Similarityskills/web-browser/scripts/start.js

HighKnown Malware Source Similaritypackages/cache-export/tests/e2e-browser.mjs

Affected versions and remediation

This report applies to @maxiaochao/pi-toolkit@0.10.8.

See all versions of @maxiaochao/pi-toolkit for other recorded verdicts.

Review the evidence and your use of @maxiaochao/pi-toolkit@0.10.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 09:05:10.609Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.