@pikaa-ai/pikaa@0.2.5
PIKAA CLI - AI coding agent that runs locally in your terminal.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe active CLI path forwards an ambient OpenAI credential to a different, package-default gateway without requiring an endpoint override. This supports blocking for credential exfiltration; the install and launcher findings do not independently establish malicious behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Run the CLI with OPENAI_API_KEY set and without overriding the model endpoint.
Impact
The gateway receives the caller’s OpenAI API key, which may permit unauthorized use of that credential.
Mechanism
The model client selects OPENAI_API_KEY as a fallback, uses api.groupy-hub.store as its default endpoint, and sends the key as a bearer authorization header.
Attack narrative
When a user starts a model request with OPENAI_API_KEY set and leaves the endpoint at its default, the CLI sends that key in a bearer header to api.groupy-hub.store. The code does not constrain the key to OpenAI’s service. This is a credential exposure path; the inspected source does not establish who controls or how the recipient uses the key.
AI rationale
The active CLI path forwards an ambient OpenAI credential to a different, package-default gateway without requiring an endpoint override. This supports blocking for credential exfiltration; the install and launcher findings do not independently establish malicious behavior.
Evidence
dist/index.js
Network endpoints1
api.groupy-hub.store/v1
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CLI falls back to the caller’s OPENAI_API_KEY and defaults its model endpoint to api.groupy-hub.store.
- The model client places the selected API key in an Authorization bearer header and sends it with the request.
- The CLI creates the model client without a default endpoint or API key override, so these fallbacks apply during ordinary use.
- The package has no install hook; its only lifecycle script is prepublishOnly.
- The flagged MCP configuration path only loads project configuration and registers tools when the user runs the CLI.
Evidence against
- The launcher downloads a native binary from the package’s GitHub Releases URL when no local binary or Bun entrypoint is available.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcebin/pikaa.jsView file
13L14: import { spawnSync } from "node:child_process";
L15: import { existsSync, chmodSync, mkdirSync, createWriteStream, readFileSync } from "node:fs";
High
•matchType = token_shingles
matchedPackage = @pikaa-ai/pikaa@0.3.7
matchedPath = bin/pikaa.js
matchedIdentity = npm:QHBpa2FhLWFpL3Bpa2Fh:0.3.7
similarity = 0.729
shingleOverlap = 35
summary = source token shingles overlapped finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/pikaa.jsView on unpkgdist/index.jsView file
524const isWindows = process.platform === "win32";
L525: const shellCmd = isWindows ? ["powershell.exe", "-NoProfile", "-Command", command] : ["/bin/sh", "-c", command];
L526: try {
High
Shell
Findings
6 High5 Medium5 Low
HighChild Processbin/pikaa.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
HighKnown Malware Source Similaritybin/pikaa.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/groupy.cmd
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @pikaa-ai/pikaa@0.2.5.
See all versions of @pikaa-ai/pikaa for other recorded verdicts.
- Avoid installing @pikaa-ai/pikaa@0.2.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.