@symerian/symi: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@symerian/symi: Suspicious npm security report (Warn) | LPM Firewall

AI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json:101 `prepare` conditionally sets Git `core.hooksPath` to `git-hooks`.
The lifecycle mutation is guarded by Git availability and an existing worktree, but changes repository configuration.

Evidence against

No `preinstall`, `install`, or `postinstall` hook is declared in package.json.
symi.mjs only dynamically imports local `dist/entry.(m)js` files.
dist/plugin-sdk/index.js remote fetch reads bounded media with SSRF controls; no decoded payload execution found.
dist/os-summary-DWMd4Vyq.js sends provider tokens only to named provider usage/quota APIs.
No foreign AI-agent configuration write or unconsented credential-exfiltration endpoint was confirmed.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 804 file(s), 20.3 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.botframework.com, api.chutes.ai, api.deepgram.com, api.example.com, api.firecrawl.dev, api.github.com, api.groq.com, api.individual.githubcopilot.com, api.kimi.com, api.minimax.io, api.minimaxi.com, api.moonshot.ai, api.moonshot.cn, api.openai.com, api.perplexity.ai, api.push.apple.com, api.sandbox.push.apple.com, api.search.brave.com, api.synthetic.new, api.together.xyz, api.venice.ai, api.voyageai.com, api.x.ai, api.xiaomimimo.com, api.z.ai, ark.ap-southeast.bytepluses.com, ark.cn-beijing.volces.com, attacker.azureedge.net, brew.sh, bun.sh, chat.example.com, chat.qwen.ai, chatgpt.com, chutes.ai, claude.ai, cloudcode-pa.googleapis.com, console.bce.baidu.com, contoso.sharepoint.com, control.example.com, docs.astral.sh, docs.symi.ai, evil.test, example.com, gateway.ai.cloudflare.com, generativelanguage.googleapis.com, github.com, go.dev, graph.microsoft.com

Oversized source lightweight scan

dist/pi-embedded-Be45iUMX.js2.17 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellWebSocketHighEntropyStringsUrlStrings127.0.0.1api.kimi.comapi.minimax.ioapi.moonshot.aiapi.synthetic.newapi.together.xyzapi.venice.aiapi.xiaomimimo.comark.ap-southeast.bytepluses.comark.cn-beijing.volces.comgateway.ai.cloudflare.comintegrate.api.nvidia.comportal.qwen.aiqianfan.baidubce.comrouter.huggingface.co

dist/run-9QcgVvVq.js2.17 MB file, sampled 256 KB

Filesystem

Source & flagged code

10 flagged · loading source

dist/auth-profiles-BSw0aQND.jsView file

12import fs$1 from "node:fs/promises"; L13: import { execFileSync } from "node:child_process"; L14: import { createHash, randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/auth-profiles-BSw0aQND.jsView on unpkg · L12

dist/plugin-sdk/index.jsView file

12import { isDeepStrictEqual, promisify } from "node:util"; L13: import { execFile, execFileSync } from "node:child_process"; L14: import crypto, { randomBytes, randomUUID } from "node:crypto"; L15: import { fileURLToPath } from "node:url"; L16: import { lookup } from "node:dns"; L17: import { lookup as lookup$1 } from "node:dns/promises"; ... L180: try { L181: return JSON.parse(raw); L182: } catch { ... L205: const expanded = expandHomePrefix(trimmed, { L206: home: resolveRequiredHomeDir(process.env, os.homedir), L207: env: process.env,

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/plugin-sdk/index.jsView on unpkg · L12

•Trigger-reachable chain: manifest.exports -> dist/plugin-sdk/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/plugin-sdk/index.jsView on unpkg

1549const ElevatedAllowFromSchema = z.record(z.string(), z.array(z.union([z.string(), z.number()]))).optional(); L1550: const ToolExecApplyPatchSchema = z.object({ L1551: enabled: z.boolean().optional(),

High

Shell

Package source references shell execution.

dist/plugin-sdk/index.jsView on unpkg · L1549

12import { isDeepStrictEqual, promisify } from "node:util"; L13: import { execFile, execFileSync } from "node:child_process"; L14: import crypto, { randomBytes, randomUUID } from "node:crypto"; L15: import { fileURLToPath } from "node:url"; L16: import { lookup } from "node:dns"; L17: import { lookup as lookup$1 } from "node:dns/promises"; ... L180: try { L181: return JSON.parse(raw); L182: } catch { ... L205: const expanded = expandHomePrefix(trimmed, { L206: home: resolveRequiredHomeDir(process.env, os.homedir), L207: env: process.env,

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/plugin-sdk/index.jsView on unpkg · L12

symi.mjsView file

20try { L21: const mod = await import(specifier); L22: if (typeof mod.installProcessWarningFilter === "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

symi.mjsView on unpkg · L20

dist/os-summary-DWMd4Vyq.jsView file

12import { n as formatTimeAgo } from "./format-relative-8cNYQsqb.js"; L13: import { spawnSync } from "node:child_process"; L14: import os from "node:os"; ... L285: if (days < 7) return `${days}d ${hours % 24}h`; L286: return new Intl.DateTimeFormat("en-US", { L287: month: "short", ... L385: } L386: function resolveFetch(fetchImpl) { L387: const resolved = fetchImpl ?? globalThis.fetch; ... L395: try { L396: const parsed = JSON.parse(apiKey); L397: if (parsed && typeof parsed.token === "string") return { token: parsed.token };

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/os-summary-DWMd4Vyq.jsView on unpkg · L12

dist/run-DhZBEsP9.jsView file

72Cross-file remote execution chain: dist/run-DhZBEsP9.js spawns dist/control-ui/vendor/marked.min.js; helper contains network access plus dynamic code execution. L72: import { a as [redacted], c as listPairingChannels, i as readChannelAllowFromStore, o as upsertChannelPairingRequest, t as addChannelAllowFromStoreEntry } fro... L73: import { _ as getTrustedSafeBinDirs, b as buildSafeShellCommand, d as resolveExecApprovals, f as resolveExecApprovalsFromFile, g as resolveSafeBins, h as evaluateShellAllowlist, i ... L74: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as writeCameraClipPayloadToFile, f as writeUrlToFile, g as normalizePathPrepend, h as mergePathPrepend, i as pa... L75: import { n as parseNodeList, r as parsePairingList, t as resolveNodeIdFromCandidates } fr

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/run-DhZBEsP9.jsView on unpkg · L72

skills/model-usage/scripts/model_usage.pyView file

•path = skills/model-usage/scripts/model_usage.py kind = build_helper sizeBytes = 10483 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/model_usage.pyView on unpkg

dist/pi-embedded-Be45iUMX.jsView file

•path = dist/pi-embedded-Be45iUMX.js kind = oversized_source_file sizeBytes = 2279054 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/pi-embedded-Be45iUMX.jsView on unpkg

Source & flagged code

10 flagged

dist/auth-profiles-BSw0aQND.jsView file

Lines 1-32javascript

1import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";

2import { o as resolveOAuthPath, s as resolveStateDir } from "./paths-CE7eVGHg.js";

3import { t as DEFAULT_AGENT_ID } from "./session-key-BmQ2R1ev.js";

4import { Y as resolveUserPath } from "./registry-C-JddWwo.js";

5import { t as createSubsystemLogger } from "./subsystem-DzRUKS9f.js";

6import { t as formatCliCommand } from "./command-format-BrrHNE8r.js";

7import { c as normalizeProviderId, h as getProviderAdapter, i as findNormalizedProviderValue } from "./model-selection-BqshlIZc.js";

8import { n as isPidAlive, t as resolveProcessScopedMap } from "./process-scoped-map-B-dHc_9I.js";

9import { n as saveJsonFile, t as loadJsonFile } from "./json-file-CZ3ssFR9.js";

10import path from "node:path";

11import fs from "node:fs";

12import fs$1 from "node:fs/promises";

13import { execFileSync } from "node:child_process";

14import { createHash, randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/auth-profiles-BSw0aQND.jsView on unpkg · L12

15import { getOAuthApiKey, getOAuthProviders } from "@mariozechner/pi-ai";

16

17//#region src/agents/auth-profiles/constants.ts

18const AUTH_STORE_VERSION = 1;

19const AUTH_PROFILE_FILENAME = "auth-profiles.json";

20const LEGACY_AUTH_FILENAME = "auth.json";

21const QWEN_CLI_PROFILE_ID = "qwen-portal:qwen-cli";

22const MINIMAX_CLI_PROFILE_ID = "minimax-portal:minimax-cli";

23const AUTH_STORE_LOCK_OPTIONS = {

24 retries: {

25 retries: 10,

26 factor: 2,

27 minTimeout: 100,

28 maxTimeout: 1e4,

29 randomize: true

30 },

31 stale: 3e4

32};

dist/plugin-sdk/index.jsView file

Lines 1-32javascript

1import { a as resolveRequiredHomeDir, i as expandHomePrefix, n as resolveDefaultConfigCandidates, r as resolveStateDir, t as resolveConfigPath } from "./paths-DfqCKCM2.js";

2import { createRequire } from "node:module";

3import path from

symi.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2

3import module from "node:module";

4

5// https://nodejs.org/api/module.html#module-compile-cache

6if (module.enableCompileCache && !process.env.NODE_DISABLE_COMPILE_CACHE) {

7 try

dist/os-summary-DWMd4Vyq.jsView file

Lines 1-32javascript

1import { At as isRecord, Q as theme, yt as resolveStateDir } from "./entry.js";

2import { b as ensureAuthProfileStore, c as resolveApiKeyForProfile, h as listProfilesForProvider, m as dedupeProfileIds, n as resolveAuthProfileOrder } from

dist/run-DhZBEsP9.jsView file

72Cross-file remote execution chain: dist/run-DhZBEsP9.js spawns dist/control-ui/vendor/marked.min.js; helper contains network access plus dynamic code execution. L72: import { a as [redacted], c as listPairingChannels, i as readChannelAllowFromStore, o as upsertChannelPairingRequest, t as addChannelAllowFromStoreEntry } fro... L73: import { _ as getTrustedSafeBinDirs, b as buildSafeShellCommand, d as resolveExecApprovals, f as resolveExecApprovalsFromFile, g as resolveSafeBins, h as evaluateShellAllowlist, i ... L74: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as writeCameraClipPayloadToFile, f as writeUrlToFile, g as normalizePathPrepend, h as mergePathPrepend, i as pa... L75: import { n as parseNodeList, r as parsePairingList, t as resolveNodeIdFromCandidates } fr

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/run-DhZBEsP9.jsView on unpkg · L72

skills/model-usage/scripts/model_usage.pyView file

•path = skills/model-usage/scripts/model_usage.py kind = build_helper sizeBytes = 10483 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/model_usage.pyView on unpkg

dist/pi-embedded-Be45iUMX.jsView file

•path = dist/pi-embedded-Be45iUMX.js kind = oversized_source_file sizeBytes = 2279054 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/pi-embedded-Be45iUMX.jsView on unpkg