registry / @pi-outpost/embed / 0.1.0

@pi-outpost/embed@0.1.0

Mount pi-outpost as a Shadow-DOM-isolated widget inside another web app.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is an explicitly mounted browser chat widget that communicates with its configured pi-outpost backend.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Host application calls mount(container, options).

Impact

User-supplied token may be sent to the configured backend as documented; no unconsented install-time or host-system action was found.

Mechanism

Shadow-DOM React widget using configured backend HTTP/WebSocket requests.

Rationale

The scanner findings are explained by a large bundled frontend dependency graph, including Mermaid Unicode data and fixed local chunk loading. Source inspection shows documented, user-invoked widget networking rather than credential theft, persistence, remote payload execution, or install-time mutation.

Evidence

package.jsonREADME.mddist/mount.d.tsdist/pi-outpost-embed.jsdist/pi-outpost-embed.cjsdist/chunk-KEIR6QF5-Cy_QBNG6.cjs

Network endpoints1

/branding

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with false-positive risk.

@pi-outpost/embed@0.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code