registry / @pasko70/pibo / 1.6.0

@pasko70/pibo@1.6.0

Minimal TypeScript wrapper around Pi Coding Agent.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

No confirmed malicious attack surface from static inspection. Risky primitives are user-invoked agent platform features, not install-time or import-time behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit pibo CLI subcommands only

Impact

No unconsented persistence, credential harvesting, exfiltration, or foreign AI-agent control hijack confirmed.

Mechanism

package-aligned agent CLI, MCP config, skill/tool installers, and runtime workers

Rationale

The scanner hits map to expected functionality for an agent-oriented CLI: user-invoked tool installation, MCP configuration, and interactive runtime execution. With no lifecycle hooks, import-time execution, exfiltration, persistence, or unconsented writes to foreign agent control surfaces, the package should not be blocked.

Evidence

package.jsondist/bin/pibo.jsdist/bin/rg.jsdist/cli.jsdist/tools/npm-runtime.jsdist/tools/registry.jsdist/tools/runtime/python-worker-source.jsdist/mcp/config.jsdist/mcp/config-command.jsdist/mcp/agent-context.jsdist/user-skills/installer.jsdist/gateway/backup.js

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/user-skills/installer.js can fetch GitHub skill directories and enable them, but only via explicit `pibo skills install <url>`.
dist/tools/npm-runtime.js runs `npm install --prefix` for curated tool runtimes under Pibo home, triggered by `pibo tools install`.
dist/tools/runtime/python-worker-source.js contains eval/exec primitives for an interactive Python runtime.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks.
dist/bin/pibo.js only dispatches the CLI; dist/bin/rg.js wraps @vscode/ripgrep with inherited stdio.
MCP config writes in dist/mcp/config-command.js are explicit CLI actions to create/update mcp_servers.json.
No inspected code writes Claude/Codex/Cursor control surfaces during install or import.
Network-capable code is package-aligned CLI functionality, not automatic exfiltration.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 530 file(s), 7.81 MB of source, external domains: 0.0.0.0, 127.0.0.1, 4788.192.168.0.204.sslip.io, aka.ms, api.github.com, api.minimax.cn, api.minimax.io, api.openai.com, api.z.ai, astral.sh, auth.openai.com, chatgpt.com, code.visualstudio.com, dev.pibo.example.com, e.co, example.com, example.invalid, example.org, example.test, github.com, lexical.dev, mcp.deepwiki.com, pi.dev, pibo.example.com, radix-ui.com, react.dev, skills.sh, www.w3.org, your-domain.example

Oversized source lightweight scan

dist/apps/chat-ui/assets/index-CNDX-4Kp.js2.01 MB file, sampled 256 KB

NetworkHighEntropyStringsMinifiedUrlStringsreact.devwww.w3.org

Source & flagged code

15 flagged

dist/tools/npm-runtime.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { existsSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/tools/npm-runtime.jsView on unpkg · L1

3import { mkdir, rm, writeFile } from 'node:fs/promises';

4import { homedir } from 'node:os';

5import { join } from 'node:path';

6import { ErrorCode, formatCliError } from '../cli-errors.js';

7import { detectDesktopEnv, getDesktopProcessEnv, hasDesktopDisplay, printDesktopEnvStatus, printLinuxVirtualDisplayHint, } from './desktop-env.js';

8function getPiboHome() {

9 return process.env.PIBO_HOME || join(homedir(), '.pibo');

10}

11export function getToolNpmRuntimePaths(name, spec) {

12 const rootDir = join(getPiboHome(), 'tools', name);

13 const homeDir = join(rootDir, 'home');

14 const nodeDir = join(rootDir, 'node');

15 const binDir = join(nodeDir, 'node_modules', '.bin');

16 const executable = process.platform === 'win32' ? `${spec.executableName}.cmd` : spec.executableName;

17 return {

18 rootDir,

19 homeDir,

20 nodeDir,

21 binDir,

dist/tools/index.jsView file

Lines 386-426javascript

386 for (const command of result.nextCommands)

387 console.log(` ${command}`);

388 }

389}

390async function printBrowserPoolReap(status, options) {

391 const

dist/tools/runtime/python-worker-source.jsView file

Lines 62-102javascript

62 runtime_frames = [frame for frame in extracted if frame.filename == "<pibo-runtime>"]

63 if runtime_frames:

64 line = runtime_frames[-1].lineno

65 except Exception:

66 pass

67 out = {"name"

dist/apps/context-files-ui/assets/index-BhAWD3dv.jsView file

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/dist-DqYw0LH7.js","assets/dist-D1KyNDg5.js","assets/dist-QQuDy4KA.js","assets/dist-vnd7PMu3.js","assets/dist-DKoyMS... L2: import{$ as e,A as t,At as n,B as r,Bt as i,C as a,Ct as o,D as s,Dt as c,E as l,Et as u,F as d,Ft as f,G as p,H as m,I as h,It as g,J as _,K as v,L as y,Lt as b,M as x,Mt as S,N a... L3: at`)?` (<anonymous>)`:-1<e.stack.indexOf(`@`)?`@unknown:0:0`:``}return` ... L8: Error generating stack: `+e.message+` L9: `+e.stack}}var Se=Object.prototype.hasOwnProperty,Ce=t.unstable_scheduleCallback,we=t.unstable_cancelCallback,Te=t.unstable_shouldYield,Ee=t.unstable_requestPaint,De=t.unstable_now... L10: `).replace(Ld,``)}function zd(e,t){return t=Rd(t),Rd(e)===t}function Bd(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||qt(e,r):(typeof... L11: `),r.hasAttribute(`data-start`)||r.setAttribute(`data-start`,String(o+1))}f.textContent=e,n.highlightElement(f)},function(e){r.setAttribute(a,c),f.textContent=e})}}),n.plugins.file... ... L31: L32: `))}return r.pop(),s.join(``)}function vp(e){let t=0,n=e.stack.length;for(;--n>-1;){let r=e.stack[n];if(r===`blockquote`|

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/apps/context-files-ui/assets/index-BhAWD3dv.jsView on unpkg · L1

185\${} L186: }`,{label:`enum`,detail:`definition`,type:`keyword`})]),yX=new re,bX=new Set([`Script`,`Block`,`FunctionExpression`,`FunctionDeclaration`,`ArrowFunction`,`MethodDeclaration`,`ForSt... L187: `:t==`r`?`\r`:t==`t`?` `:`\\`)}eq(e){return this.search==e.search&&this.replace==e.replace&&this.caseSensitive==e.caseSensitive&&this.regexp==e.regexp&&this.wholeWord==e.wholeWord&...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/apps/context-files-ui/assets/index-BhAWD3dv.js

dist/apps/chat/trace.jsView file

Lines 1-29javascript

1import { createHash } from "node:crypto";

2import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";

3import { homedir } from "node:os";

4import { join } from "node:path";

5import { parseSessionEntries, SessionManager } from "@mariozechner/pi-coding-agent";

dist/setup/cli.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { resolve4 } from "node:dns/promises";

3import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/setup/cli.jsView on unpkg · L1

4import { dirname, isAbsolute, join } from "node:path";

dist/gateway/fallback.jsView file

Lines 74-114javascript

74 web: { host: FALLBACK_HOST, port: FALLBACK_WEB_PORT },

75 };

76}

77export async function startFallback() {

78 if (!existsSync(BACKUP_DIR)) {

dist/tools/python-runtime.jsView file

1import { spawn } from 'node:child_process'; L2: import { existsSync } from 'node:fs'; ... L8: function getPiboHome() { L9: return process.env.PIBO_HOME || join(homedir(), '.pibo'); L10: } ... L14: const venvDir = join(rootDir, '.venv'); L15: const binDir = join(venvDir, process.platform === 'win32' ? 'Scripts' : 'bin'); L16: const executable = process.platform === 'win32' ... L38: const chunks = []; L39: child.stdout.on('data', (chunk) => chunks.push(Buffer.from(chunk))); L40: child.stderr.on('data', (chunk) => chunks.push(Buffer.from(chunk))); ... L66: console.log('uv was not found on PATH. Installing uv automatically.');

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/tools/python-runtime.jsView on unpkg · L1

dist/gateway/backup.jsView file

50} L51: execSync("npm install --include=dev", { cwd: BACKUP_DIR, stdio: "inherit" }); L52: execSync("npm run build", { cwd: BACKUP_DIR, stdio: "inherit" });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/gateway/backup.jsView on unpkg · L50

skills/builtin/skill-creator/eval-viewer/generate_review.pyView file

•path = skills/builtin/skill-creator/eval-viewer/generate_review.py kind = build_helper sizeBytes = 16836 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/builtin/skill-creator/eval-viewer/generate_review.pyView on unpkg

dist/apps/vscode-artifacts/latest.vsixView file

•path = dist/apps/vscode-artifacts/latest.vsix kind = high_entropy_blob sizeBytes = 326594 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/apps/vscode-artifacts/latest.vsixView on unpkg

•path = dist/apps/vscode-artifacts/latest.vsix kind = compressed_blob sizeBytes = 326594 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/apps/vscode-artifacts/latest.vsixView on unpkg

•path = dist/apps/vscode-artifacts/latest.vsix kind = nested_archive_needs_inspection sizeBytes = 326594 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/apps/vscode-artifacts/latest.vsixView on unpkg

dist/apps/chat-ui/assets/index-CNDX-4Kp.jsView file

•path = dist/apps/chat-ui/assets/index-CNDX-4Kp.js kind = oversized_source_file sizeBytes = 2111580 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/apps/chat-ui/assets/index-CNDX-4Kp.jsView on unpkg

Source & flagged code

15 flagged · loading source

dist/tools/npm-runtime.jsView file

1import { spawn } from 'node:child_process'; L2: import { existsSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/tools/npm-runtime.jsView on unpkg · L1

dist/tools/index.jsView file

406for (const name of candidates) { L407: const result = spawnSync('command', ['-v', name], { shell: true, encoding: 'utf-8' }); L408: if (result.status === 0 && result.stdout.trim()) {

High

Shell

Package source references shell execution.

dist/tools/index.jsView on unpkg · L406

dist/tools/runtime/python-worker-source.jsView file

82if mode == "eval": L83: value = eval(compile(code, "<pibo-runtime>", "eval"), user_globals, user_globals) L84: else:

High

Eval

Package source references dynamic code evaluation.

dist/tools/runtime/python-worker-source.jsView on unpkg · L82

dist/apps/context-files-ui/assets/index-BhAWD3dv.jsView file

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/apps/context-files-ui/assets/index-BhAWD3dv.jsView on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/apps/context-files-ui/assets/index-BhAWD3dv.jsView on unpkg · L185

dist/apps/chat/trace.jsView file

9export { compareTraceNodes, sortTraceNodes, nestTraceNodes, flattenTraceNodes, mapTraceNodesById, buildTraceViewFromEvents, traceNodesFromEntries, } from "../../shared/trace-engine... L10: export async function loadPiSessionMetadata(session, cwd = process.cwd()) { L11: const piSession = await findPiSession(session, cwd); ... L127: title: s.title ?? null, L128: metadata: s.metadata, L129: })), ... L268: function defaultPiSessionDir(cwd) { L269: const agentDir = process.env.PI_CODING_AGENT_DIR ?? join(homedir(), ".pi", "agent"); L270: const safePath = `--${cwd.replace(/^[\\/]/, "").replace(/[\\/:]/g, "-")}--`;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/apps/chat/trace.jsView on unpkg · L9

dist/setup/cli.jsView file

1import { execFileSync } from "node:child_process"; L2: import { resolve4 } from "node:dns/promises"; L3: import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; ... L120: warnings.push("No production domain was provided; generated Caddy/Auth examples use placeholders."); L121: if (process.platform === "win32" && !isWsl()) { L122: warnings.push("Pibo host setup targets Linux. Native Windows is not supported. Install WSL2 (https://aka.ms/wsl) and run setup inside the WSL distribution. See docs/guides/pibo-on-... ... L166: "Set auth.baseURL, auth.secret, OAuth client values, and allowed emails with `pibo config set`.", L167: `Install ${serviceName}.service, then run \`systemctl enable --now ${serviceName}\`.`, L168: "If Caddy is used, point DNS at the host before expecting Let's Encrypt certificates.",

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/setup/cli.jsView on unpkg · L1

dist/gateway/fallback.jsView file

94} L95: const child = spawn(process.execPath, [FALLBACK_BIN_PATH, "gateway", "fallback", "run"], { L96: detached: true, ... L98: cwd: BACKUP_DIR, L99: env: { ...process.env, PIBO_FALLBACK_MODE: "1" }, L100: }); ... L108: console.log(` Gateway: 0.0.0.0:${FALLBACK_GATEWAY_PORT}`); L109: console.log(` Web App: http://0.0.0.0:${FALLBACK_WEB_PORT}/apps/chat`); L110: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/gateway/fallback.jsView on unpkg · L94

dist/tools/python-runtime.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/tools/python-runtime.jsView on unpkg · L1

dist/gateway/backup.jsView file

50} L51: execSync("npm install --include=dev", { cwd: BACKUP_DIR, stdio: "inherit" }); L52: execSync("npm run build", { cwd: BACKUP_DIR, stdio: "inherit" });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/gateway/backup.jsView on unpkg · L50

skills/builtin/skill-creator/eval-viewer/generate_review.pyView file

•path = skills/builtin/skill-creator/eval-viewer/generate_review.py kind = build_helper sizeBytes = 16836 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/builtin/skill-creator/eval-viewer/generate_review.pyView on unpkg

dist/apps/vscode-artifacts/latest.vsixView file

•path = dist/apps/vscode-artifacts/latest.vsix kind = high_entropy_blob sizeBytes = 326594 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/apps/vscode-artifacts/latest.vsixView on unpkg

•path = dist/apps/vscode-artifacts/latest.vsix kind = compressed_blob sizeBytes = 326594 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/apps/vscode-artifacts/latest.vsixView on unpkg

•path = dist/apps/vscode-artifacts/latest.vsix kind = nested_archive_needs_inspection sizeBytes = 326594 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/apps/vscode-artifacts/latest.vsixView on unpkg

dist/apps/chat-ui/assets/index-CNDX-4Kp.jsView file

•path = dist/apps/chat-ui/assets/index-CNDX-4Kp.js kind = oversized_source_file sizeBytes = 2111580 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/apps/chat-ui/assets/index-CNDX-4Kp.jsView on unpkg

Findings

1 Critical8 High8 Medium8 Low

CriticalDownload Executedist/apps/context-files-ui/assets/index-BhAWD3dv.js

HighChild Processdist/tools/npm-runtime.js

HighShelldist/tools/index.js

HighEvaldist/tools/runtime/python-worker-source.js

HighSame File Env Network Executiondist/gateway/fallback.js

HighSandbox Evasion Gated Capabilitydist/tools/python-runtime.js

HighRuntime Package Installdist/gateway/backup.js

HighShips High Entropy Blobdist/apps/vscode-artifacts/latest.vsix

HighOversized Source Filedist/apps/chat-ui/assets/index-CNDX-4Kp.js

MediumDynamic Requiredist/apps/context-files-ui/assets/index-BhAWD3dv.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/setup/cli.js

MediumProtestware

MediumShips Build Helperskills/builtin/skill-creator/eval-viewer/generate_review.py

MediumShips Compressed Blobdist/apps/vscode-artifacts/latest.vsix

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/apps/chat/trace.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiondist/apps/vscode-artifacts/latest.vsix

LowNo License

Source & flagged code

15 flagged

dist/tools/npm-runtime.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { existsSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/tools/npm-runtime.jsView on unpkg · L1

3import { mkdir, rm, writeFile } from 'node:fs/promises';

4import { homedir } from 'node:os';

5import { join } from 'node:path';

6import { ErrorCode, formatCliError } from '../cli-errors.js';

7import { detectDesktopEnv, getDesktopProcessEnv, hasDesktopDisplay, printDesktopEnvStatus, printLinuxVirtualDisplayHint, } from './desktop-env.js';

8function getPiboHome() {

9 return process.env.PIBO_HOME || join(homedir(), '.pibo');

10}

11export function getToolNpmRuntimePaths(name, spec) {

12 const rootDir = join(getPiboHome(), 'tools', name);

13 const homeDir = join(rootDir, 'home');

14 const nodeDir = join(rootDir, 'node');

15 const binDir = join(nodeDir, 'node_modules', '.bin');

16 const executable = process.platform === 'win32' ? `${spec.executableName}.cmd` : spec.executableName;

17 return {

18 rootDir,

19 homeDir,

20 nodeDir,

21 binDir,

dist/tools/index.jsView file

Lines 386-426javascript

386 for (const command of result.nextCommands)

387 console.log(` ${command}`);

388 }

389}

390async function printBrowserPoolReap(status, options) {

391 const

dist/tools/runtime/python-worker-source.jsView file

Lines 62-102javascript

62 runtime_frames = [frame for frame in extracted if frame.filename == "<pibo-runtime>"]

63 if runtime_frames:

64 line = runtime_frames[-1].lineno

65 except Exception:

66 pass

67 out = {"name"

dist/apps/context-files-ui/assets/index-BhAWD3dv.jsView file

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/apps/context-files-ui/assets/index-BhAWD3dv.jsView on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/apps/context-files-ui/assets/index-BhAWD3dv.js

dist/apps/chat/trace.jsView file

Lines 1-29javascript

1import { createHash } from "node:crypto";

2import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";

3import { homedir } from "node:os";

4import { join } from "node:path";

5import { parseSessionEntries, SessionManager } from "@mariozechner/pi-coding-agent";

dist/setup/cli.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { resolve4 } from "node:dns/promises";

3import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/setup/cli.jsView on unpkg · L1

4import { dirname, isAbsolute, join } from "node:path";

dist/gateway/fallback.jsView file

Lines 74-114javascript

74 web: { host: FALLBACK_HOST, port: FALLBACK_WEB_PORT },

75 };

76}

77export async function startFallback() {

78 if (!existsSync(BACKUP_DIR)) {

dist/tools/python-runtime.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/tools/python-runtime.jsView on unpkg · L1

dist/gateway/backup.jsView file

50} L51: execSync("npm install --include=dev", { cwd: BACKUP_DIR, stdio: "inherit" }); L52: execSync("npm run build", { cwd: BACKUP_DIR, stdio: "inherit" });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/gateway/backup.jsView on unpkg · L50

skills/builtin/skill-creator/eval-viewer/generate_review.pyView file

•path = skills/builtin/skill-creator/eval-viewer/generate_review.py kind = build_helper sizeBytes = 16836 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/builtin/skill-creator/eval-viewer/generate_review.pyView on unpkg

dist/apps/vscode-artifacts/latest.vsixView file

•path = dist/apps/vscode-artifacts/latest.vsix kind = high_entropy_blob sizeBytes = 326594 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/apps/vscode-artifacts/latest.vsixView on unpkg

•path = dist/apps/vscode-artifacts/latest.vsix kind = compressed_blob sizeBytes = 326594 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/apps/vscode-artifacts/latest.vsixView on unpkg

•path = dist/apps/vscode-artifacts/latest.vsix kind = nested_archive_needs_inspection sizeBytes = 326594 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/apps/vscode-artifacts/latest.vsixView on unpkg

dist/apps/chat-ui/assets/index-CNDX-4Kp.jsView file

•path = dist/apps/chat-ui/assets/index-CNDX-4Kp.js kind = oversized_source_file sizeBytes = 2111580 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/apps/chat-ui/assets/index-CNDX-4Kp.jsView on unpkg