registry / @maxiaochao/pi-toolkit / 0.11.16
@maxiaochao/pi-toolkit@0.11.16
Personal pi coding agent toolkit: scheduler, /btw, /cache_export, apply_patch, browser automation, and bundled theme/skills.
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe postinstall hook mutates global agent configuration and user-level command paths without asking for separate consent. Its bundled guidance appears package-aligned and benign, so this warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package through npm, which runs its postinstall hook.
Impact
These changes persist in the user's global agent configuration and command paths without a separate setup prompt; the bundled guidance inspected is general coding advice.
Mechanism
The hook writes the bundled AGENTS.md to ~/.pi/agent/AGENTS.md when absent or different, initializes a missing theme setting, and installs pi-worktree files under the user's home directory.
AI rationale
The postinstall hook mutates global agent configuration and user-level command paths without asking for separate consent. Its bundled guidance appears package-aligned and benign, so this warrants a warning rather than a block.
Evidence
package.jsonscripts/install-agents.mjsglobal/AGENTS.mdpackages/worktree/scripts/install.mjs~/.pi/agent/AGENTS.md~/.pi/agent/settings.json~/.local/bin/pi-worktree~/.local/share/bash-completion/completions/pi-worktree
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs scripts/install-agents.mjs from a postinstall hook.
- The hook copies the bundled AGENTS.md to the user's global Pi agent directory, replacing it when its contents differ.
- The hook also seeds a missing theme setting and installs the package's pi-worktree command and shell completion under the user's home directory.
- The bundled AGENTS.md contains general coding guidance; the inspected text does not direct this review or describe a payload.
- The CLI installer copies package-owned files into user-level bin and completion directories.
Evidence against
- The inspected install behavior uses package-bundled files and defaults; no credential transfer or network endpoint was identified in the hook.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
17 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-agents.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackages/worktree/tests/extension.test.mjsView file
57L58: const extension = (await import(`${extensionUrl}?test=${Math.random()}`)).default;
L59: extension(pi);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
packages/worktree/tests/extension.test.mjsView on unpkg · L57scripts/install-agents.mjsView file
1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme
L2: // without overriding a theme the user has already selected.
L3: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
L4: import { homedir } from "node:os";
...
L11: const agentDir = join(homedir(), ".pi", "agent");
L12: const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8");
L13: const agentsTarget = join(agentDir, "AGENTS.md");
L14: const settingsTarget = join(agentDir, "settings.json");
...
L16: if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) {
L17: mkdirSync(dirname(agentsTarget), { recursive: true });
L18: writeFileSync(agentsTarget, bundled, "utf8");
L19: console.log("[pi-toolkit]
Findings
1 Critical13 High6 Medium5 Low
CriticalAi Agent Control Hijackscripts/install-agents.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighPayload In Excluded Dirpackages/worktree/tests/run-tests.sh
HighSemantic Analysis Limitedpackages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1
HighKnown Malware Source Similarityskills/web-browser/scripts/start.js
HighKnown Malware Source Similaritypackages/cache-export/tests/e2e-browser.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/run-with-budget.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/select-tasks.mjs
HighKnown Malware Source Similaritypackages/codex-edit/tests/generate-test-report.mjs
Affected versions and remediation
This report applies to @maxiaochao/pi-toolkit@0.11.16.
See all versions of @maxiaochao/pi-toolkit for other recorded verdicts.
- Review the evidence and your use of @maxiaochao/pi-toolkit@0.11.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.