registry / Credential exfiltration / @pikaa-ai/pikaa / 0.2.2

@pikaa-ai/pikaa@0.2.2

PIKAA CLI - AI coding agent that runs locally in your terminal.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The client combines OPENAI_API_KEY with a default gateway that is not identified as OpenAI, and sends the key to that endpoint. This supports a credential exposure warning, but does not establish a malicious credential theft chain.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A user runs the CLI with OPENAI_API_KEY set and no endpoint override.

Impact

The gateway receives the key, creating a risk of exposure outside the intended OpenAI service.

Mechanism

The client selects that key, defaults the base URL to the Groupy gateway, and uses the key as a bearer token in its chat request.

AI rationale

Evidence

dist/index.js

Network endpoints1

api.groupy-hub.store/v1

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The model client can select OPENAI_API_KEY while defaulting to the Groupy gateway.
When a key is present, the client sends it as a bearer token to the selected chat endpoint.

Evidence against

The manifest has a prepublishOnly build hook, not an install lifecycle hook.
The CLI loads project MCP configuration when the CLI runs; the inspected code does not show an install-time agent configuration change.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 3 file(s), 316 KB of source, external domains: api.groupy-hub.store, bun.sh, github.com

Source & flagged code

8 flagged

bin/pikaa.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3/**

4 * Universal Native Launcher for Pikaa Agent CLI.

5 *

6 * Automatically detects platform (macOS, Linux, Windows) and architecture (arm64, x64).

7 * If the native binary is already present, runs it with 0ms startup time.

8 * If not present (e.g. postinstall script skipped by npm allow-scripts), automatically

9 * downloads the native binary from GitHub Releases to ~/.pikaa/bin/ and executes it.

10 *

11 * Zero external dependencies required. Does NOT require Bun or compilation tools.

12 */

14import { spawnSync } from "node:child_process";

15import { existsSync, chmodSync, mkdirSync, createWriteStream, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/pikaa.jsView on unpkg · L13

16import { fileURLToPath } from "node:url";

17import { dirname, join } from "node:path";

18import { homedir } from "node:os";

19import { pipeline } from "node:stream/promises";

20import https from "node:https";

22const __filename = fileURLToPath(import.meta.url);

23const __dirname = dirname(__filename);

24const rootDir = join(__dirname, "..");

26const platform = process.platform;

27const arch = process.arch;

29function getBinaryName() {

30 if (platform === "win32") return arch === "arm64" ? "pikaa-windows-arm64.exe" : "pikaa-windows-x64.exe";

31 if (platform === "darwin") return arch === "arm64" ? "pikaa-darwin-arm64" : "pikaa-darwin-x64";

32 if (platform === "linux") return arch === "arm64" ? "pikaa-linux-arm64" : "pikaa-linux-x64";

33 return null;

Lines 101-138javascript

101 const pkg = JSON.parse(readFileSync(join(rootDir, "package.json"), "utf8"));

102 version = pkg.version;

103 } catch {}

104

105 const

dist/index.jsView file

Lines 27-67javascript

28class ExecutionPolicyError extends GroupyError {

29 constructor(message) {

30 super(message, "EXEC_POLICY_DENIED", false);

31 this.name

bin/groupy.cmdView file

•path = bin/groupy.cmd kind = build_helper sizeBytes = 95 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/groupy.cmdView on unpkg

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @pikaa-ai/pikaa@0.1.9 matchedPath = dist/cli.js matchedIdentity = npm:QHBpa2FhLWFpL3Bpa2Fh:0.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

8 flagged · loading source

bin/pikaa.jsView file

13L14: import { spawnSync } from "node:child_process"; L15: import { existsSync, chmodSync, mkdirSync, createWriteStream, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/pikaa.jsView on unpkg · L13

121if (existsSync(jsEntry)) { L122: const probe = spawnSync("bun", ["--version"], { encoding: "utf8" }); L123: if (!probe.error) { ... L125: stdio: "inherit", L126: env: process.env, L127: }); ... L131: L132: console.error(`\nPlease check your internet connection or install Bun (https://bun.sh) and retry.`); L133: process.exit(1);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/pikaa.jsView on unpkg · L121

dist/index.jsView file

509const isWindows = process.platform === "win32"; L510: const shellCmd = isWindows ? ["powershell.exe", "-NoProfile", "-Command", command] : ["/bin/sh", "-c", command]; L511: try {

Findings

7 High5 Medium5 Low

HighChild Processbin/pikaa.js

HighShelldist/index.js

HighSame File Env Network Executionbin/pikaa.js

HighCredential Redirect Persistencedist/index.js

HighRemote Agent Bridgedist/index.js

HighKnown Malware Source Similaritydist/cli.js

HighKnown Malware Source Similaritydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/groupy.cmd

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

Low

Affected versions and remediation

This report applies to @pikaa-ai/pikaa@0.2.2.

See all versions of @pikaa-ai/pikaa for other recorded verdicts.

Review the evidence and your use of @pikaa-ai/pikaa@0.2.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 22:19:31.932Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.