registry / @pi-outpost/embed / 0.6.0

@pi-outpost/embed@0.6.0

Mount pi-outpost as a Shadow-DOM-isolated widget inside another web app.

AI Security Review

scanned 19h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The widget performs user-invoked browser networking only after mount() to the configured pi-outpost server.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A host application calls mount(container, { serverUrl, token }) and the rendered widget connects.

Impact

No install-time execution, filesystem access, credential harvesting, exfiltration target, persistence, or AI-agent control-surface mutation was established.

Mechanism

Shadow-DOM React widget fetches branding and opens a WebSocket to the configured backend.

Rationale

The package is a browser widget whose network destination is selected by the consuming host via serverUrl or same-origin defaults. Its bundled dynamic imports are local Mermaid/highlighting assets, and source inspection found no concrete malicious chain.

Evidence

package.jsonREADME.mddist/mount.d.tsdist/pi-outpost-embed.jsdist/pi-outpost-embed.cjsdist/chunk-KEIR6QF5-Cy_QBNG6.cjs

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

@pi-outpost/embed@0.6.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code