Loading npm security reports…

@maxiaochao/pi-toolkit@0.3.0: AI-agent control-surface risk | LPM Firewall

registry / @maxiaochao/pi-toolkit / 0.3.0

@maxiaochao/pi-toolkit@0.3.0

Personal pi coding agent toolkit: /todos, /btw, /cache_export extensions, browser automation, and bundled theme/skills.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The automatic postinstall hook mutates the user's global Pi agent control surface. It replaces global instructions when they differ and creates or changes related user-wide files.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation

Impact

A dependency installation can replace instructions applied to Pi agent sessions without an explicit setup command.

Mechanism

Postinstall overwrite of global agent configuration and user-wide command installation.

Policy narrative

Installing the package invokes its postinstall hook. The hook reads its bundled global instruction file and overwrites the user's global Pi AGENTS.md whenever it differs, so it controls a broad agent instruction surface without an explicit user command. It also creates or modifies Pi settings and copies an executable and shell completion into user-wide locations.

AI rationale

The package has a concrete automatic lifecycle path that overwrites a foreign, broad AI-agent control surface. Although no exfiltration was found, this satisfies the install-time agent-control mutation blocking policy.

Evidence

package.jsonscripts/install-agents.mjsglobal/AGENTS.md~/.pi/agent/AGENTS.md~/.pi/agent/settings.jsonbin/pi-worktree~/.local/bin/pi-worktreebin/pi-worktree-completion.bash~/.local/share/bash-completion/completions/pi-worktree

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-agents.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/install-agents.mjsView file

1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme L2: // without overriding a theme the user has already selected. L3: import { readFileSync, writeFileSync, mkdirSync, existsSync, copyFileSync, chmodSync } from "node:fs"; L4: import { homedir, platform } from "node:os"; ... L10: const agentDir = join(homedir(), ".pi", "agent"); L11: const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8"); L12: const agentsTarget = join(agentDir, "AGENTS.md"); L13: const settingsTarget = join(agentDir, "settings.json"); ... L15: if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) { L16: mkdirSync(dirname(agentsTarget), { recursive: true }); L17: writeFileSync(agentsTarget, bundled, "utf8

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-agents.mjsView on unpkg · L1

bin/pi-worktree-completion.bashView file

•path = bin/pi-worktree-completion.bash kind = build_helper sizeBytes = 1193 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/pi-worktree-completion.bashView on unpkg

bin/pi-worktreeView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/pi-worktreeView on unpkg

skills/web-browser/scripts/start.jsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.2.6 matchedPath = skills/web-browser/scripts/start.js matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/web-browser/scripts/start.jsView on unpkg

extensions/cache-export/tests/e2e-browser.mjsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.2.6 matchedPath = extensions/cache-export/tests/e2e-browser.mjs matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/cache-export/tests/e2e-browser.mjsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node scripts/install-agents.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/install-agents.mjsView file

Lines 1-21javascript

1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme

2// without overriding a theme the user has already selected.

3import { readFileSync, writeFileSync, mkdirSync, existsSync, copyFileSync, chmodSync } from "node:fs";

4import { homedir, platform } from "node:os";

5import { dirname, join } from "node:path";

6import { fileURLToPath } from "node:url";

7

8const packageRoot = join(dirname(fileURLToPath(import.meta.url)), "..");

9

10const agentDir = join(homedir(), ".pi", "agent");

11const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8");

12const agentsTarget = join(agentDir, "AGENTS.md");

13const settingsTarget = join(agentDir, "settings.json");

14

15if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) {

16 mkdirSync(dirname(agentsTarget), { recursive: true });

17 writeFileSync(agentsTarget, bundled, "utf8");

18 console.log("[pi-toolkit] global AGENTS.md synced ->", agentsTarget);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-agents.mjsView on unpkg · L1

19}

20

21function writeSettings(settings) {

bin/pi-worktree-completion.bashView file

•path = bin/pi-worktree-completion.bash kind = build_helper sizeBytes = 1193 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/pi-worktree-completion.bashView on unpkg

bin/pi-worktreeView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/pi-worktreeView on unpkg

skills/web-browser/scripts/start.jsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.2.6 matchedPath = skills/web-browser/scripts/start.js matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/web-browser/scripts/start.jsView on unpkg

extensions/cache-export/tests/e2e-browser.mjsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.2.6 matchedPath = extensions/cache-export/tests/e2e-browser.mjs matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/cache-export/tests/e2e-browser.mjsView on unpkg