@maxiaochao/pi-toolkit@0.11.11
Personal pi coding agent toolkit: scheduler, /btw, /cache_export, apply_patch, browser automation, and bundled theme/skills.
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe manifest activates the hook during installation, and the hook replaces the global agent instruction file without a consent guard. This is unconsented postinstall mutation of an AI-agent control surface.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Installing the package through npm with its postinstall hook enabled.
Impact
This changes instructions used by the user’s global agent and can replace existing custom instructions without affirmative consent.
Mechanism
The hook reads global/AGENTS.md, targets ~/.pi/agent/AGENTS.md, and writes the bundled file whenever the target is absent or different.
Policy narrative
During npm postinstall, the package copies its bundled global agent instructions into ~/.pi/agent/AGENTS.md whenever the existing file differs. This silently replaces user-managed global agent instructions, so the install hook modifies a broad agent control surface without affirmative consent.
AI rationale
The manifest activates the hook during installation, and the hook replaces the global agent instruction file without a consent guard. This is unconsented postinstall mutation of an AI-agent control surface.
Evidence
package.jsonscripts/install-agents.mjsglobal/AGENTS.md~/.pi/agent/AGENTS.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs scripts/install-agents.mjs automatically at postinstall.
- The hook loads the package’s global/AGENTS.md and targets the user’s ~/.pi/agent/AGENTS.md.
- If that target differs, the hook writes the bundled instructions over it without a consent check.
- The bundled file supplies behavioral instructions for the global agent configuration.
Evidence against
- The bundled instructions describe general coding practices; the inspected install path shows no credential transfer or network activity.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
12 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-agents.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackages/worktree/tests/extension.test.mjsView file
57L58: const extension = (await import(`${extensionUrl}?test=${Math.random()}`)).default;
L59: extension(pi);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
packages/worktree/tests/extension.test.mjsView on unpkg · L57scripts/install-agents.mjsView file
1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme
L2: // without overriding a theme the user has already selected.
L3: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
L4: import { homedir } from "node:os";
...
L11: const agentDir = join(homedir(), ".pi", "agent");
L12: const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8");
L13: const agentsTarget = join(agentDir, "AGENTS.md");
L14: const settingsTarget = join(agentDir, "settings.json");
...
L16: if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) {
L17: mkdirSync(dirname(agentsTarget), { recursive: true });
L18: writeFileSync(agentsTarget, bundled, "utf8");
L19: console.log("[pi-toolkit]
Findings
1 Critical8 High6 Medium5 Low
CriticalAi Agent Control Hijackscripts/install-agents.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighPayload In Excluded Dirpackages/worktree/tests/run-tests.sh
HighSemantic Analysis Limitedpackages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1
HighKnown Malware Source Similarityskills/web-browser/scripts/start.js
HighKnown Malware Source Similaritypackages/cache-export/tests/e2e-browser.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/run-with-budget.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/select-tasks.mjs
HighKnown Malware Source Similaritypackages/codex-edit/tests/generate-test-report.mjs
Affected versions and remediation
This report applies to @maxiaochao/pi-toolkit@0.11.11.
See all versions of @maxiaochao/pi-toolkit for other recorded verdicts.
- Avoid installing @maxiaochao/pi-toolkit@0.11.11. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.