@maxiaochao/pi-toolkit@0.11.13
Personal pi coding agent toolkit: scheduler, /btw, /cache_export, apply_patch, browser automation, and bundled theme/skills.
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe manifest automatically runs an installer that overwrites global agent instructions without consent. This is unconsented postinstall mutation of an AI-agent control surface.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing the package through npm triggers its postinstall hook.
Impact
This changes behavioral instructions used by the user's global Pi agent configuration.
Mechanism
The hook copies the bundled AGENTS.md over ~/.pi/agent/AGENTS.md whenever the file is absent or differs.
Policy narrative
An npm postinstall hook writes package-provided behavioral instructions into the user's global Pi agent directory. It replaces a differing existing file and has no affirmative consent guard, so package installation changes the agent's global control surface.
AI rationale
The manifest automatically runs an installer that overwrites global agent instructions without consent. This is unconsented postinstall mutation of an AI-agent control surface.
Evidence
package.jsonscripts/install-agents.mjsglobal/AGENTS.md~/.pi/agent/AGENTS.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs scripts/install-agents.mjs automatically from postinstall.
- The installer targets ~/.pi/agent/AGENTS.md and loads the package’s bundled global instructions.
- Without a consent check, the installer overwrites that global file when it is missing or differs from the bundled copy.
- The bundled file contains behavioral guidance for coding agents, affecting the global agent configuration.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
16 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-agents.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackages/worktree/tests/extension.test.mjsView file
57L58: const extension = (await import(`${extensionUrl}?test=${Math.random()}`)).default;
L59: extension(pi);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
packages/worktree/tests/extension.test.mjsView on unpkg · L57scripts/install-agents.mjsView file
1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme
L2: // without overriding a theme the user has already selected.
L3: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
L4: import { homedir } from "node:os";
...
L11: const agentDir = join(homedir(), ".pi", "agent");
L12: const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8");
L13: const agentsTarget = join(agentDir, "AGENTS.md");
L14: const settingsTarget = join(agentDir, "settings.json");
...
L16: if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) {
L17: mkdirSync(dirname(agentsTarget), { recursive: true });
L18: writeFileSync(agentsTarget, bundled, "utf8");
L19: console.log("[pi-toolkit]
Findings
1 Critical12 High6 Medium5 Low
CriticalAi Agent Control Hijackscripts/install-agents.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighPayload In Excluded Dirpackages/worktree/tests/run-tests.sh
HighSemantic Analysis Limitedpackages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1
HighKnown Malware Source Similarityskills/web-browser/scripts/start.js
HighKnown Malware Source Similaritypackages/cache-export/tests/e2e-browser.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/run-with-budget.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/select-tasks.mjs
HighKnown Malware Source Similaritypackages/codex-edit/tests/generate-test-report.mjs
Affected versions and remediation
This report applies to @maxiaochao/pi-toolkit@0.11.13.
See all versions of @maxiaochao/pi-toolkit for other recorded verdicts.
- Avoid installing @maxiaochao/pi-toolkit@0.11.13. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.