Loading npm security reports…

@maxiaochao/pi-toolkit@0.4.0: Malicious npm security report | LPM Firewall

registry / @maxiaochao/pi-toolkit / 0.4.0

@maxiaochao/pi-toolkit@0.4.0

Personal pi coding agent toolkit: /todos, /btw, /cache_export extensions, browser automation, and bundled theme/skills.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Installing the package automatically overwrites a global Pi agent instruction file and modifies user-wide command locations. This changes an AI-agent control surface without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation triggers postinstall.

Impact

A package installation can replace instructions used by the user's Pi agent and persist a package-provided executable in the user's path.

Mechanism

Postinstall writes global agent configuration and copies a command-line executable.

Attack narrative

The npm postinstall hook runs without a separate user setup action. It compares the user's global Pi AGENTS.md with a bundled replacement and overwrites it whenever the contents differ, making the package's instructions apply to the global agent. The same hook also copies a package executable and shell completion into user-wide directories. This is broad, persistent mutation of an AI-agent control surface and command environment.

AI rationale

Automatic installation overwrites a foreign global AI-agent instruction file and installs user-wide command files. That concrete lifecycle behavior meets the install-hook abuse policy despite no observed exfiltration.

Evidence

package.jsonscripts/install-agents.mjsglobal/AGENTS.md~/.pi/agent/AGENTS.md~/.pi/agent/settings.json~/.local/bin/pi-worktree~/.local/share/bash-completion/completions/pi-worktree

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-agents.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

extensions/cache-export/tests/e2e-browser.mjsView file

12L13: import { spawn, execFileSync } from "node:child_process"; L14: import { existsSync, mkdtempSync, readdirSync, rmSync } from "node:fs";

High

Child Process

Package source references child process execution.

extensions/cache-export/tests/e2e-browser.mjsView on unpkg · L12

187const userDataDir = usesWindowsChrome L188: ? commandOutput("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", L189: "[Environment]::GetFolderPath('LocalApplicationData')"]) + `\\agent-web\\e2e-${process.pid}`

High

Shell

Package source references shell execution.

extensions/cache-export/tests/e2e-browser.mjsView on unpkg · L187

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.3.0 matchedPath = extensions/cache-export/tests/e2e-browser.mjs matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/cache-export/tests/e2e-browser.mjsView on unpkg

skills/chrome-cdp/scripts/cdp.mjsView file

12import { resolve } from 'path'; L13: import { spawn } from 'child_process'; L14: import net from 'net'; L15: ... L24: const RUNTIME_DIR = IS_WINDOWS L25: ? resolve(process.env.LOCALAPPDATA || resolve(homedir(), 'AppData', 'Local'), 'cdp') L26: : process.env.XDG_RUNTIME_DIR

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

skills/chrome-cdp/scripts/cdp.mjsView on unpkg · L12

scripts/install-agents.mjsView file

1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme L2: // without overriding a theme the user has already selected. L3: import { readFileSync, writeFileSync, mkdirSync, existsSync, copyFileSync, chmodSync } from "node:fs"; L4: import { homedir, platform } from "node:os"; ... L10: const agentDir = join(homedir(), ".pi", "agent"); L11: const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8"); L12: const agentsTarget = join(agentDir, "AGENTS.md"); L13: const settingsTarget = join(agentDir, "settings.json"); ... L15: if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) { L16: mkdirSync(dirname(agentsTarget), { recursive: true }); L17: writeFileSync(agentsTarget, bundled, "utf8

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-agents.mjsView on unpkg · L1

bin/pi-worktree-completion.bashView file

•path = bin/pi-worktree-completion.bash kind = build_helper sizeBytes = 1368 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/pi-worktree-completion.bashView on unpkg

bin/pi-worktreeView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/pi-worktreeView on unpkg

skills/web-browser/scripts/start.jsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.3.0 matchedPath = skills/web-browser/scripts/start.js matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/web-browser/scripts/start.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 34-60json

34 "./themes"

35 ]

36 },

37 "bin": {

38 "pi-worktree": "bin/pi-worktree"

39 },

40 "peerDependencies": {

41 "@earendil-works/pi-ai": "*",

42 "@earendil-works/pi-coding-agent": "*",

43 "@earendil-works/pi-tui": "*",

44 "typebox": "*"

45 },

46 "dependencies": {

47 "ws": "^8.19.0"

48 },

49 "scripts": {

50 "test": "cd extensions/cache-export && node --experimental-strip-types tests/run-tests.mjs && node --experimental-strip-types ../tests/btw-history.mjs && node tests/e2e-browser.mjs",

51 "load-test": "pi -ne -e ./extensions/todo.ts && pi -ne -e ./extensions/cache-export/index.ts && pi -ne -e ./extensions/btw.ts",

52 "eval:agents": "node evaluations/agents-md/run.mjs",

53 "eval:agents:test": "node evaluations/agents-md/tests/run-tests.mjs",

54 "postinstall": "node scripts/install-agents.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

55 },

56 "publishConfig": {

57 "access": "public"

58 }

59}

60

extensions/cache-export/tests/e2e-browser.mjsView file

Lines 1-32javascript

1// Real-browser end-to-end test for the cache dashboard.

2// Drives actual pointer events in headless Chromium via raw CDP (Node 22

3// built-ins only: fetch + WebSocket) and asserts the hover tooltip keeps

4// working across polyline break boundaries and inside segment views.

5//

6// Chrome discovery mirrors the web-browser skill (BROWSER_BIN, common Linux

7// paths, Playwright cache, WSL Windows Chrome). If no browser is found the

8// test prints SKIP and exits 0 so CI without Chrome still passes; if a

9// browser IS found, failing assertions exit 1.

skills/chrome-cdp/scripts/cdp.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2// cdp - lightweight Chrome DevTools Protocol CLI

3// Uses raw CDP over WebSocket, no Puppeteer dependency.

4// Requires Node 22+ (built-in WebSocket).

5//

6// Per-tab persistent daemon: page commands go through a daemon that holds

7// the CDP session open. Chrome's "Allow debugging" modal fires once per

8// daemon (= once per tab). Daemons auto-exit after 20min idle.

9

10import { readFileSync, writeFileSync, unlinkSync, existsSync, mkdirSync }

scripts/install-agents.mjsView file

Lines 1-21javascript

1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme

2// without overriding a theme the user has already selected.

3import { readFileSync, writeFileSync, mkdirSync, existsSync, copyFileSync, chmodSync } from "node:fs";

4import { homedir, platform } from "node:os";

5import { dirname, join } from "node:path";

bin/pi-worktree-completion.bashView file

•path = bin/pi-worktree-completion.bash kind = build_helper sizeBytes = 1368 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/pi-worktree-completion.bashView on unpkg

bin/pi-worktreeView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/pi-worktreeView on unpkg

skills/web-browser/scripts/start.jsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.3.0 matchedPath = skills/web-browser/scripts/start.js matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/web-browser/scripts/start.jsView on unpkg