@pikaa-ai/pikaa@0.1.5
PIKAA CLI - AI coding agent that runs locally in your terminal.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe unrestricted endpoint override creates a conditional credential-forwarding risk, so this warrants a warning rather than a block. No install-time attack or unconsented agent configuration mutation was established.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user runs the CLI with an API key or saved access token and configures an alternate base URL through environment variables or the command line.
Impact
A credential may be exposed to an unintended endpoint if the caller configures an untrusted destination.
Mechanism
The client selects the credential and base URL independently, then sends the credential in the Authorization bearer header to that URL.
AI rationale
The unrestricted endpoint override creates a conditional credential-forwarding risk, so this warrants a warning rather than a block. No install-time attack or unconsented agent configuration mutation was established.
Evidence
dist/index.jsdist/cli.js
Network endpoints1
api.groupy-hub.store
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI loads a saved access token and accepts environment-selected API keys and base URLs.
- The model client sends the selected key as a bearer token to the selected base URL; overrides are not restricted to the package gateway.
- The manifest exposes the CLI and model client, making this behavior reachable during ordinary use.
- The reported agent configuration location loads project MCP configuration when the CLI runs; this is user-invoked behavior.
Evidence against
- The default model endpoint is the package’s Groupy gateway, and no install lifecycle hook is declared.
- The inspected CLI launcher only starts a bundled native binary or the JavaScript entrypoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flagged · loading sourcebin/pikaa.jsView file
10L11: import { spawnSync } from "node:child_process";
L12: import { existsSync, chmodSync } from "node:fs";
High
79L80: import(jsEntry).catch((err) => {
L81: console.error("Failed to start CLI:", err);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/pikaa.jsView on unpkg · L79dist/index.jsView file
509const isWindows = process.platform === "win32";
L510: const shellCmd = isWindows ? ["powershell.exe", "-NoProfile", "-Command", command] : ["/bin/sh", "-c", command];
L511: try {
High
Findings
7 High6 Medium5 Low
HighChild Processbin/pikaa.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
HighKnown Malware Source Similaritydist/cli.js
HighKnown Malware Source Similaritydist/index.js
MediumDynamic Requirebin/pikaa.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/groupy.cmd
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @pikaa-ai/pikaa@0.1.5.
See all versions of @pikaa-ai/pikaa for other recorded verdicts.
- Review the evidence and your use of @pikaa-ai/pikaa@0.1.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.