@maxiaochao/pi-toolkit@0.11.5
Personal pi coding agent toolkit: scheduler, /btw, /cache_export, apply_patch, browser automation, and bundled theme/skills.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe postinstall hook performs an unconsented write to a global agent instruction file and replaces differing user content. This is a concrete agent control-surface hijack, so publication should be blocked.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Installing the package through npm.
Impact
Package-supplied instructions take over the user's global Pi agent instruction file, potentially overriding user-defined agent behavior.
Mechanism
The hook writes the bundled AGENTS.md to ~/.pi/agent/AGENTS.md without asking before replacing an existing file.
Policy narrative
During npm postinstall, the package copies its bundled global AGENTS.md into the user's Pi agent directory whenever the existing file differs. This can replace user-defined global instructions without consent, making the lifecycle hook an unconsented mutation of an agent control surface.
AI rationale
The postinstall hook performs an unconsented write to a global agent instruction file and replaces differing user content. This is a concrete agent control-surface hijack, so publication should be blocked.
Evidence
package.jsonscripts/install-agents.mjsglobal/AGENTS.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 91.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs scripts/install-agents.mjs during postinstall.
- The script targets the user's global Pi agent directory and loads the package's bundled AGENTS.md.
- If the target file differs, the script replaces it without a consent check.
- The replacement is a global agent instruction file, so the install hook can replace user-defined agent instructions.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
12 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-agents.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackages/worktree/tests/extension.test.mjsView file
57L58: const extension = (await import(`${extensionUrl}?test=${Math.random()}`)).default;
L59: extension(pi);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
packages/worktree/tests/extension.test.mjsView on unpkg · L57scripts/install-agents.mjsView file
1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme
L2: // without overriding a theme the user has already selected.
L3: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
L4: import { homedir } from "node:os";
...
L11: const agentDir = join(homedir(), ".pi", "agent");
L12: const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8");
L13: const agentsTarget = join(agentDir, "AGENTS.md");
L14: const settingsTarget = join(agentDir, "settings.json");
...
L16: if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) {
L17: mkdirSync(dirname(agentsTarget), { recursive: true });
L18: writeFileSync(agentsTarget, bundled, "utf8");
L19: console.log("[pi-toolkit]
Findings
1 Critical8 High6 Medium5 Low
CriticalAi Agent Control Hijackscripts/install-agents.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighPayload In Excluded Dirpackages/worktree/tests/run-tests.sh
HighSemantic Analysis Limitedpackages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1
HighKnown Malware Source Similarityskills/web-browser/scripts/start.js
HighKnown Malware Source Similaritypackages/cache-export/tests/e2e-browser.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/run-with-budget.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/select-tasks.mjs
HighKnown Malware Source Similaritypackages/codex-edit/tests/generate-test-report.mjs
Affected versions and remediation
This report applies to @maxiaochao/pi-toolkit@0.11.5.
See all versions of @maxiaochao/pi-toolkit for other recorded verdicts.
- Avoid installing @maxiaochao/pi-toolkit@0.11.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.