registry / @oh-my-pi/pi-coding-agent / 16.2.11

@oh-my-pi/pi-coding-agent@16.2.11

Coding agent CLI with read, bash, edit, write tools and session management

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious install-time or import-time behavior was found. Risky primitives are aligned with an explicitly run coding-agent CLI and extension/plugin system.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs omp CLI or enables agent features

Impact

No unconsented persistence, credential exfiltration, or foreign AI-agent control-surface mutation confirmed

Mechanism

user-invoked agent runtime with plugin, shell, browser, MCP, and trace tooling

Rationale

Static inspection found an agent CLI with dangerous but package-aligned, user-invoked capabilities and no lifecycle hook or hidden persistence path. Scanner hits are explained by documented runtime extension loading, local shell snapshotting, browser evaluation, and explicit Claude trace tooling rather than malware.

Evidence

package.jsonsrc/main.tssrc/index.tssrc/extensibility/custom-tools/loader.tssrc/discovery/claude.tssrc/discovery/claude-plugins.tssrc/cli/claude-trace-cli.tssrc/utils/shell-snapshot.tssrc/tools/browser/aria/aria-snapshot.tsdist/types/cli/claude-trace-cli.d.ts

Network endpoints1

registry.npmjs.org/@oh-my-pi/pi-coding-agent/latest

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no npm lifecycle install hooks; bin is user-invoked dist/cli.js.
src/main.ts update check only fetches npm registry when startup.checkUpdate is enabled.
src/extensibility/custom-tools/loader.ts dynamically imports configured user/plugin tool paths at runtime, not install time.
src/discovery/claude.ts reads .claude config surfaces but registers provider loaders only for the agent runtime.
src/cli/claude-trace-cli.ts MITM proxy and embedded debug cert/key are for an explicit trace command against local Claude CLI traffic.
src/tools/browser/aria/aria-snapshot.ts new Function wraps a committed ARIA bundle for browser snapshot evaluation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,046 file(s), 11.7 MB of source, external domains: 127.0.0.1, addons.mozilla.org, api.coingecko.com, api.crossref.org, api.discogs.com, api.exa.ai, api.firecrawl.dev, api.github.com, api.kimi.com, api.npmjs.org, api.nuget.org, api.openai.com, api.opencorporates.com, api.osv.dev, api.parallel.ai, api.perplexity.ai, api.rawg.io, api.search.brave.com, api.search.tinyfish.ai, api.semanticscholar.org, api.smithery.ai, api.snapcraft.io, api.stackexchange.com, api.synthetic.new, api.tavily.com, api.w3.org, api.x.ai, api.z.ai, artifacthub.io, arxiv.org, aur.archlinux.org, auth.example.com, blog.platformatic.dev, bun.sh, chatgpt.com, cheat.sh, choosealicense.com, cli.github.com, clojars.org, cloudcode-pa.googleapis.com, community.chocolatey.org, covers.openlibrary.org, crates.io, daily-cloudcode-pa.googleapis.com, daily-cloudcode-pa.sandbox.googleapis.com, data.sec.gov, dev.to, docs.rs, doi.org, engineering.example.com

Oversized source lightweight scan

dist/cli.js11.5 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsDynamicRequireHighEntropyStringsMinifiedUrlStrings127.0.0.1registry.npmjs.org

Source & flagged code

10 flagged

dist/types/cli/claude-trace-cli.d.tsView file

Lines 1-22typescript

1export declare const CLAUDE_TRACE_DEBUG_CERT = "-----BEGIN CERTIFICATE-----\nMIIDFzCCAf+gAwIBAgIUAe9omAqLbydZc5ZYZGhwbbpMSF0wDQYJKoZIhvcNAQEL\nBQAwGzEZMBcGA1UEAwwQb21wLWNsYXVkZS10cmFjZTAeFw0yNjA2MDIwODA2MjFa\nFw0zNjA1MzAwODA2MjFaMBsxGTAXBgNVBAMMEG9tcC1jbGF1ZGUtdHJhY2UwggEi\nMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCmpGe5T8B0oA2L82Rn5JJdXOBS\nZX0DyBjiIK+Tqe8T3oAr41XDLnweqtrMDSBDYbVqAoKjNbaTUSYYcxSm0MAVs63w\n08SfJmShZM9pElfANqXqMiyhksFgji7JEyt/rbbId207a7s5KvRvm3g/sxN/wGtr\nC5LCLMlc2GWEGD8qrVIQbmLw884qvtXi70RFUPP3Wpy4wGMWSdE+9IA27R5cMJS5\noHsO4HGB6J8VzLY+HGY2yr4BJ9qrAyjd1UetFd9RdcjyWpsbAfX8nWP+uleTN ...

2export declare const CLAUDE_TRACE_DEBUG_KEY = "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCmpGe5T8B0oA2L\n82Rn5JJdXOBSZX0DyBjiIK+Tqe8T3oAr41XDLnweqtrMDSBDYbVqAoKjNbaTUSYY\ncxSm0MAVs63w08SfJmShZM9pElfANqXqMiyhksFgji7JEyt/rbbId207a7s5KvRv\nm3g/sxN/wGtrC5LCLMlc2GWEGD8qrVIQbmLw884qvtXi70RFUPP3Wpy4wGMWSdE+\n9IA27R5cMJS5oHsO4HGB6J8VzLY+HGY2yr4BJ9qrAyjd1UetFd9RdcjyWpsbAfX8\nnWP+uleTNOiTExNz7dPt/k6OPLNmI1iT/ruRS0uUzHZTimPd67TPQR/70RaW7Bh5\nwArawGw9AgMBAAECggEADX2mhA3H0pPuj35J36X/5Me9xWM//AwOr6febwGalazg\nCtg3EOZ01/VptzaiKQetAdhoLmxidooNn9HD7JQJKPid7q7w7m1+R26mN/xrLD ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/types/cli/claude-trace-cli.d.tsView on unpkg · L2

Critical

Secret Pattern

RSA private key in dist/types/cli/claude-trace-cli.d.ts

dist/types/cli/claude-trace-cli.d.tsView on unpkg · L2

3export interface HeaderEntry {

4 name: string;

5 value: string;

7export interface CapturedRequest {

8 method: string;

9 path: string;

10 version: string;

11 headers: HeaderEntry[];

12 body: string;

13}

14export interface CapturedResponse {

15 statusCode: number | undefined;

16 statusMessage: string;

17 version: string;

18 headers: HeaderEntry[];

19 body: string;

20}

21export interface CapturedMessagesExchange {

22 target: string;

Long lines were clipped for display.

src/tools/browser/aria/aria-snapshot.tsView file

Lines 7-47typescript

7// (fetches the pinned tag, bundles in a temp dir, rewrites the .txt artifact.)

9export interface AriaSnapshotOptions {

10 /** Maximum tree depth to render. */

11 depth?: number;

12 /** Append `[box=x,y,w,h]` bounding boxes to each node. */

13 boxes?: boolean;

src/extensibility/custom-tools/loader.tsView file

Lines 27-67typescript

27async function loadTool(

28 toolPath: string,

29 cwd: string,

30 sharedApi: CustomToolAPI,

31 source?: { provider: string

src/utils/shell-snapshot.tsView file

Lines 1-24typescript

1/**

2 * Shell environment snapshot for preserving user aliases, functions, and options.

3 *

4 * Creates a snapshot file that captures the user's shell environment from their

5 * .bashrc/.zshrc, which can be sourced before each command to provide a familiar

6 * shell experience.

7 */

8import * as fs from "node:fs";

9import *

src/utils/shell-snapshot-fn-env.shView file

•path = src/utils/shell-snapshot-fn-env.sh kind = build_helper sizeBytes = 2947 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/utils/shell-snapshot-fn-env.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 12053168 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 12053168 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

src/tools/eval-render.tsView file

Lines 228-268typescript

228 } else if (lastIntent) {

229 lines.push(`${cont}${theme.tree.hook} ${theme.fg("dim", truncateToWidth(replaceTabs(lastIntent), 48))}`);

230 }

src/cli/claude-trace-cli.tsView file

Lines 30-70typescript

30export const CLAUDE_TRACE_DEBUG_CERT = `-----BEGIN CERTIFICATE-----

31MIIDFzCCAf+gAwIBAgIUAe9omAqLbydZc5ZYZGhwbbpMSF0wDQYJKoZIhvcNAQEL

32BQAwGzEZMBcGA1UEAwwQb21wLWNsYXVkZS10cmFjZTAeFw0yNjA2MDIwODA2MjFa

33Fw0zNjA1MzAwODA2MjFaMBsxGTAXBgNVBAMMEG9tcC1jbGF1ZGUtdHJhY2UwggEi

34MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCmpGe5T8B0oA2L82Rn5JJdXOBS

35ZX0DyBjiIK+Tqe8T3oAr41XDLnweqtrMDSBDYbVqAoKjNbaTUSYYcxSm0MAVs63w

3608SfJmShZM9pElfANqXqMiyhksFgji7JEyt/rbbId207a7s5KvRvm3g/sxN/wGtr

37C5LCLMlc2GWEGD8qrVIQbmLw884qvtXi70RFUPP3Wpy4wGMWSdE+9IA27R5cMJS5

Source & flagged code

10 flagged · loading source

dist/types/cli/claude-trace-cli.d.tsView file

2patternName = private_key_rsa severity = critical line = 2 matchedText = export d...--";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/types/cli/claude-trace-cli.d.tsView on unpkg · L2

2patternName = private_key_rsa severity = critical line = 2 matchedText = export d...--";

Critical

Secret Pattern

RSA private key in dist/types/cli/claude-trace-cli.d.ts

dist/types/cli/claude-trace-cli.d.tsView on unpkg · L2

src/tools/browser/aria/aria-snapshot.tsView file

27function buildEvaluator(params: string, call: string): (...args: unknown[]) => unknown { L28: return new Function( L29: ...params.split(",").map(p => p.trim()),

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/tools/browser/aria/aria-snapshot.tsView on unpkg · L27

src/extensibility/custom-tools/loader.tsView file

47try { L48: const module = await import(resolvedPath); L49: const factory = (module.default ?? module) as CustomToolFactory;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/extensibility/custom-tools/loader.tsView on unpkg · L47

src/utils/shell-snapshot.tsView file

4* Creates a snapshot file that captures the user's shell environment from their L5: * .bashrc/.zshrc, which can be sourced before each command to provide a familiar L6: * shell experience. ... L20: * (`crates/vendor/brush-core/src/interp.rs:1500`, tracking L21: * https://github.com/reubeno/brush/issues/57): the resulting pieces are dropped L22: * into argv verbatim instead of going through the shell parser. Any alias body ... L88: * Honours `env.HOME` when present so a caller can target a sandboxed/test L89: * home, falling back to `os.homedir()` (which Bun resolves once at startup L90: * and caches — `process.env.HOME` overrides don't affect it). L91: */ ... L113: // Function extraction differs between bash and zsh. Each form prints function L114: // bodies on stdout so we can both persist them AND scan their bodies for

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/utils/shell-snapshot.tsView on unpkg · L4

src/utils/shell-snapshot-fn-env.shView file

•path = src/utils/shell-snapshot-fn-env.sh kind = build_helper sizeBytes = 2947 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/utils/shell-snapshot-fn-env.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 12053168 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 12053168 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

src/tools/eval-render.tsView file

248patternName = generic_password severity = medium line = 248 matchedText = pwd: "...

Medium

Secret Pattern

Hardcoded password in src/tools/eval-render.ts

src/tools/eval-render.tsView on unpkg · L248

src/cli/claude-trace-cli.tsView file

50patternName = private_key_rsa severity = critical line = 50 matchedText = export c...----

Critical

Secret Pattern

RSA private key in src/cli/claude-trace-cli.ts

src/cli/claude-trace-cli.tsView on unpkg · L50

Findings

3 Critical1 High8 Medium7 Low

CriticalCritical Secretdist/types/cli/claude-trace-cli.d.ts

CriticalSecret Patterndist/types/cli/claude-trace-cli.d.ts

CriticalSecret Patternsrc/cli/claude-trace-cli.ts

HighOversized Source Filedist/cli.js

MediumDynamic Requiresrc/extensibility/custom-tools/loader.ts

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/utils/shell-snapshot.ts

MediumShips Build Helpersrc/utils/shell-snapshot-fn-env.sh

MediumOversized Cli Entrypointdist/cli.js

MediumStructural Risk Force Deep Review

MediumSecret Patternsrc/tools/eval-render.ts

LowScripts Present

LowEvalsrc/tools/browser/aria/aria-snapshot.ts

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

86%Pass

Verdict confidence

IntentBenign

False-positive riskLow

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

AuthorCan Boluk

Maintainerscan1357

Version16.3.9

PublishedJul 1, 2026

LicenseMIT

Dependencies38

Integrityverified

Package size8.41 MB

Files2,408

Keywordscoding-agentaillmclituiagent

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./src/index.tstypes → ./dist/types/index.d.tsexports mapbin → omp

Runtimebun >=1.3.14

Artifact28.4 MB · 2,408 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: bench:guard, build, check, check:docs +8

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocketHighEntropyStringsMinifiedObfuscatedTelemetryUrlStringsManifest: clean