Loading npm security reports…

@maxiaochao/pi-toolkit@0.9.4: AI-agent control-surface risk | LPM Firewall

registry / @maxiaochao/pi-toolkit / 0.9.4

@maxiaochao/pi-toolkit@0.9.4

Personal pi coding agent toolkit: /todos, /btw, /cache_export and apply_patch extensions, browser automation, and bundled theme/skills.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation replaces global Pi agent instructions with package-supplied behavioral rules. Existing user instructions are overwritten without consent.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation with lifecycle scripts enabled.

Impact

Changes agent behavior across projects and removes existing global instructions.

Mechanism

The postinstall script reads global/AGENTS.md and writes it to the user's .pi/agent/AGENTS.md whenever the destination is absent or differs.

Policy narrative

The npm postinstall hook loads bundled agent instructions and replaces the user's global Pi instruction file. Its comparison explicitly causes differing existing instructions to be overwritten. No prompt, saved consent preference, or package-specific destination guards this operation. Subsequent installations can repeat the replacement when bundled instructions change.

AI rationale

The inspected source proves unconsented postinstall mutation of a broad AI-agent control surface. This meets the supplied blocking policy even though the replacement instructions appear conventional.

Evidence

package.jsonscripts/install-agents.mjsglobal/AGENTS.md.pi/agent/AGENTS.md

Decision evidence

public snapshot

with false-positive risk.

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-agents.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

packages/cache-export/tests/e2e-browser.mjsView file

12L13: import { spawn, execFileSync } from "node:child_process"; L14: import { existsSync, mkdtempSync, readdirSync, rmSync } from "node:fs";

High

Child Process

Package source references child process execution.

packages/cache-export/tests/e2e-browser.mjsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.5.2 matchedPath = extensions/cache-export/tests/e2e-browser.mjs matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cache-export/tests/e2e-browser.mjsView on unpkg

skills/web-browser/scripts/start.jsView file

61L62: function powershellQuote(value) { L63: return `'${String(value).replaceAll("'", "''")}'`;

High

Shell

Package source references shell execution.

skills/web-browser/scripts/start.jsView on unpkg · L61

skills/chrome-cdp/scripts/cdp.mjsView file

12import { resolve } from 'path'; L13: import { spawn } from 'child_process'; L14: import net from 'net'; L15: ... L24: const RUNTIME_DIR = IS_WINDOWS L25: ? resolve(process.env.LOCALAPPDATA || resolve(homedir(), 'AppData', 'Local'), 'cdp') L26: : process.env.XDG_RUNTIME_DIR

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

skills/chrome-cdp/scripts/cdp.mjsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.5.2 matchedPath = skills/chrome-cdp/scripts/cdp.mjs matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/chrome-cdp/scripts/cdp.mjsView on unpkg

scripts/install-agents.mjsView file

1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme L2: // without overriding a theme the user has already selected. L3: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs"; L4: import { homedir } from "node:os"; ... L11: const agentDir = join(homedir(), ".pi", "agent"); L12: const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8"); L13: const agentsTarget = join(agentDir, "AGENTS.md"); L14: const settingsTarget = join(agentDir, "settings.json"); ... L16: if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) { L17: mkdirSync(dirname(agentsTarget), { recursive: true }); L18: writeFileSync(agentsTarget, bundled, "utf8"); L19: console.log("[pi-toolkit]

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-agents.mjsView on unpkg · L1

skills/pdlog/tools/ppmdView file

•path = skills/pdlog/tools/ppmd kind = native_binary sizeBytes = 68456 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

skills/pdlog/tools/ppmdView on unpkg

packages/worktree/bin/pi-worktree-completion.bashView file

•path = packages/worktree/bin/pi-worktree-completion.bash kind = build_helper sizeBytes = 1368 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/worktree/bin/pi-worktree-completion.bashView on unpkg

packages/worktree/tests/run-tests.shView file

•path = packages/worktree/tests/run-tests.sh kind = payload_in_excluded_dir sizeBytes = 1413 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

packages/worktree/tests/run-tests.shView on unpkg

packages/worktree/bin/pi-worktreeView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/worktree/bin/pi-worktreeView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 44-70json

44 "./themes"

45 ]

46 },

47 "bin": {

48 "pi-worktree": "packages/worktree/bin/pi-worktree"

49 },

50 "peerDependencies": {

51 "@earendil-works/pi-ai": "*",

52 "@earendil-works/pi-coding-agent": "*",

53 "@earendil-works/pi-tui": "*",

54 "typebox": "*"

55 },

56 "dependencies": {

57 "ws": "^8.19.0"

58 },

59 "scripts": {

60 "test": "node tests/package-layout.mjs && npm --prefix packages/todo test && npm --prefix packages/cache-export test && npm --prefix packages/codex-edit test && npm --prefix packages/tiny-subagent test && npm --prefix packages/worktree test && node --experimental-strip-types extensions/btw/tests/history.mjs",

61 "load-test": "pi -ne -e ./packages/todo/extensions/todo.ts && pi -ne -e ./packages/cache-export/extensions/cache-export.ts && pi -ne -e ./extensions/btw/index.ts && pi -ne -e ./packages/codex-edit/extensions/codex-edit.ts && pi -ne -e ./packages/tiny-subagent/extensions/tiny-subagent.ts",

62 "eval:agents": "node evaluations/agents-md/run.mjs",

63 "eval:agents:test": "node evaluations/agents-md/tests/run-tests.mjs",

64 "postinstall": "node scripts/install-agents.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L64

65 },

66 "publishConfig": {

67 "access": "public"

68 }

69}

70

packages/cache-export/tests/e2e-browser.mjsView file

Lines 1-32javascript

1// Real-browser end-to-end test for the cache dashboard.

2// Drives actual pointer events in headless Chromium via raw CDP (Node 22

3// built-ins only: fetch + WebSocket) and asserts the hover tooltip keeps

4// working across polyline break boundaries and inside segment views.

5//

6// Chrome discovery mirrors the web-browser skill (BROWSER_BIN, common Linux

7// paths, Playwright cache, WSL Windows Chrome). If no browser is found the

8// test prints SKIP and exits 0 so CI without Chrome still passes; if a

9// browser IS found, failing assertions exit 1.

skills/web-browser/scripts/start.jsView file

Lines 41-81javascript

41

42const HOME = process.env["HOME"] || homedir();

43const CACHE_ROOT = join(HOME, ".cache", "agent-web"

skills/chrome-cdp/scripts/cdp.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2// cdp - lightweight Chrome DevTools Protocol CLI

3// Uses raw CDP over WebSocket, no Puppeteer dependency.

4// Requires Node 22+ (built-in WebSocket).

5//

6// Per-tab persistent daemon: page commands go through a daemon that holds

7// the CDP session open. Chrome's "Allow debugging" modal fires once per

8// daemon (= once per tab). Daemons auto-exit after 20min idle.

9

10import { readFileSync, writeFileSync, unlinkSync, existsSync, mkdirSync }

scripts/install-agents.mjsView file

Lines 1-21javascript

1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme

2// without overriding a theme the user has already selected.

3import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";

4import { homedir } from "node:os";

5import { dirname, join } from "node:path";

skills/pdlog/tools/ppmdView file

•path = skills/pdlog/tools/ppmd kind = native_binary sizeBytes = 68456 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

skills/pdlog/tools/ppmdView on unpkg

packages/worktree/bin/pi-worktree-completion.bashView file

•path = packages/worktree/bin/pi-worktree-completion.bash kind = build_helper sizeBytes = 1368 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/worktree/bin/pi-worktree-completion.bashView on unpkg

packages/worktree/tests/run-tests.shView file

•path = packages/worktree/tests/run-tests.sh kind = payload_in_excluded_dir sizeBytes = 1413 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

packages/worktree/tests/run-tests.shView on unpkg

packages/worktree/bin/pi-worktreeView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/worktree/bin/pi-worktreeView on unpkg