registry / Credential exfiltration / @pikaa-ai/pikaa / 0.1.7

@pikaa-ai/pikaa@0.1.7

PIKAA CLI - AI coding agent that runs locally in your terminal.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Source inspection confirms a concrete cross-service credential forwarding risk: OPENAI_API_KEY may be sent to the package's default Groupy gateway unless the user configures another base URL. The gateway is part of the package's stated service, but the OpenAI credential is not constrained to its intended service, so this warrants a warning rather than a malware block.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Running the CLI with OPENAI_API_KEY set while no explicit or saved base URL is available, then making a model request.

Impact

The gateway receives the OpenAI API key, which could allow its use outside the user's intended OpenAI service.

Mechanism

The CLI passes the OpenAI key into the model client; the client defaults to the Groupy gateway and sends the key in the Authorization bearer header. The destination is configurable, but the default is not bound to OpenAI.

AI rationale

Evidence

dist/cli.jsdist/index.js

Network endpoints1

api.groupy-hub.store/v1

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The CLI accepts OPENAI_API_KEY and passes it to the model client; its base URL may remain unset when no service URL is configured. [dist/cli.js]
The model client uses the package's Groupy gateway as the default base URL while selecting OPENAI_API_KEY as a credential source. [dist/index.js]
The client adds that key as a bearer token to its request to the selected gateway. [dist/index.js]
The flagged CLI location loads MCP configuration from the project directory; it does not itself establish an attack. [dist/cli.js]

Evidence against

The package has no automatic install lifecycle hook; its only publication hook builds JavaScript. [package.json]
The launcher runs a bundled native binary when present or imports the CLI entrypoint otherwise. [bin/pikaa.js]

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

Source & flagged code

9 flagged

bin/pikaa.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

3/**

4 * Universal Cross-Platform Dispatcher for Pikaa / Groupy Agent.

5 *

6 * Automatically detects platform (Windows, macOS, Linux) and architecture (x64, arm64).

7 * If a native compiled binary is present, executes it for instant native performance.

8 * Otherwise, seamlessly falls back to the bundled JavaScript runtime.

9 */

11import { spawnSync } from "node:child_process";

12import { existsSync, chmodSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/pikaa.jsView on unpkg · L10

13import { fileURLToPath } from "node:url";

14import { dirname, join } from "node:path";

16const __filename = fileURLToPath(import.meta.url);

17const __dirname = dirname(__filename);

18const rootDir = join(__dirname, "..");

20const platform = process.platform;

21const arch = process.arch;

23// Map OS & Arch to precompiled binary filename

24function getBinaryName() {

25 if (platform === "win32") {

26 return arch === "arm64" ? "pikaa-windows-arm64.exe" : "pikaa-windows-x64.exe";

27 }

28 if (platform === "darwin") {

29 return arch === "arm64" ? "pikaa-darwin-arm64" : "pikaa-darwin-x64";

30 }

Lines 59-85javascript

59 chmodSync(nativeBinaryPath, 0o755);

60 } catch {}

61 }

63 const result = spawnSync(nativeBinaryPath, process.argv.slice(2), {

64 stdio: "inherit",

dist/index.jsView file

Lines 27-67javascript

28class ExecutionPolicyError extends GroupyError {

29 constructor(message) {

30 super(message, "EXEC_POLICY_DENIED", false);

31 this.name

bin/groupy.cmdView file

•path = bin/groupy.cmd kind = build_helper sizeBytes = 95 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/groupy.cmdView on unpkg

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @pikaa-ai/pikaa@0.1.9 matchedPath = dist/cli.js matchedIdentity = npm:QHBpa2FhLWFpL3Bpa2Fh:0.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

9 flagged · loading source

bin/pikaa.jsView file

10L11: import { spawnSync } from "node:child_process"; L12: import { existsSync, chmodSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/pikaa.jsView on unpkg · L10

79L80: import(jsEntry).catch((err) => { L81: console.error("Failed to start CLI:", err);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/pikaa.jsView on unpkg · L79

dist/index.jsView file

509const isWindows = process.platform === "win32"; L510: const shellCmd = isWindows ? ["powershell.exe", "-NoProfile", "-Command", command] : ["/bin/sh", "-c", command]; L511: try {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L509

Findings

7 High6 Medium5 Low

HighChild Processbin/pikaa.js

HighShelldist/index.js

HighSame File Env Network Executiondist/index.js

HighCredential Redirect Persistencedist/index.js

HighRemote Agent Bridgedist/index.js

HighKnown Malware Source Similaritydist/cli.js

HighKnown Malware Source Similaritydist/index.js

MediumDynamic Requirebin/pikaa.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/groupy.cmd

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

Affected versions and remediation

This report applies to @pikaa-ai/pikaa@0.1.7.

See all versions of @pikaa-ai/pikaa for other recorded verdicts.

Review the evidence and your use of @pikaa-ai/pikaa@0.1.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 22:20:00.216Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.