registry / @pi-outpost/embed / 0.5.7

@pi-outpost/embed@0.5.7

Mount pi-outpost as a Shadow-DOM-isolated widget inside another web app.

AI Security Review

scanned 21h ago · by lpm-firewall-ai

No confirmed malicious attack surface. At runtime, a host application explicitly calls `mount()` to render a chat widget that contacts its configured pi-outpost server.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Host application calls `mount(container, options)` in a browser.

Impact

Normal widget traffic and token persistence are limited to the host-selected server and browser storage; no install-time or host-file mutation is established.

Mechanism

Shadow-DOM widget with configured-server fetch and WebSocket communication.

Rationale

The package is a browser embed widget whose networking is activated only by explicit host use and directed to a user-supplied or same-origin server. Scanner signals stem from a large bundled UI and are not corroborated by malicious source behavior.

Evidence

package.jsonREADME.mddist/pi-outpost-embed.jsdist/pi-outpost-embed.cjsdist/chunk-KEIR6QF5-Cy_QBNG6.cjs

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with high false-positive risk.

Evidence for block

`dist/pi-outpost-embed.js` opens a WebSocket only after the host calls `mount()`.

@pi-outpost/embed@0.5.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code