registry / @tekmidian/pai / 0.42.0
@tekmidian/pai@0.42.0
PAI Knowledge OS — Personal AI Infrastructure with federated memory and project management
AI Security Review
scanned 11d ago · by lpm-firewall-aiInspected source shows interactive, package-aligned setup and no install-time execution or concrete attack behavior. The scanner’s credential and agent-configuration indicators map to user-driven Todoist setup and local PAI integration.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the setup or daemon-install command, or an installed hook runs in its configured agent session.
Impact
These inspected behaviors configure the package’s stated functionality; no unconsented credential forwarding or malicious control-surface mutation was established.
Mechanism
Setup writes package-provided agent configuration and can register the PAI daemon; hooks access PAI or project-local files. The Todoist token is used through the Todoist setup flow after user approval.
AI rationale
Inspected source shows interactive, package-aligned setup and no install-time execution or concrete attack behavior. The scanner’s credential and agent-configuration indicators map to user-driven Todoist setup and local PAI integration.
Evidence
package.jsondist/program-CruRnLtc.mjsdist/hooks/capture-all-events.mjsdist/hooks/capture-session-summary.mjsdist/hooks/capture-tool-output.mjsdist/hooks/context-compression-hook.mjsdist/hooks/initialize-session.mjsdist/hooks/load-project-context.mjs
Network endpoints1
app.todoist.com/app/settings/integrations/developer
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines only a prepublish build hook; it has no install-time lifecycle hook.
- Setup prompts before overwriting a custom agent configuration and offers the package’s own configuration template.
- The environment Todoist token is offered for explicit approval before setup uses it.
- The flagged hook locations resolve to PAI or project-local paths; inspection found no foreign credential recipient or uncontrolled agent mutation there.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
11 flagged · loading sourcedist/router-DD6D4j31.mjsView file
2import { connect } from "node:net";
L3: import { spawn } from "node:child_process";
L4:
High
Child Process
Package source references child process execution.
dist/router-DD6D4j31.mjsView on unpkg · L2dist/program-CruRnLtc.mjsView file
3803],
L3804: shell: true
L3805: });
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/program-CruRnLtc.mjs:
import { appendFileSync, chmodSync, copyFileSync, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, statSync, s...
import { createInterface } from "node:readline";
* 08 - Others/MDF/Infrastruktur/.claude/worktrees/cool-haibt 1 session
* 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions
fragment: `${sep}.claude${sep}worktrees${sep}`,
writeFileSync(join(targetPath, "Notes", "MEMORY.md"), memoryContent, "utf-8");
const claudeProjects = join(homedir(), ".claude", "projects");
writeFileSync(configPath, JSON.strin
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/program-CruRnLtc.mjsView on unpkg•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
l.template.md");
if (!existssync(templatepath)) {
console.log(c.warn("skill template not found: " + templatepath));
console.log(c.dim(" skipping pai skill installation."));
return false;
}
const skilldir = join(homedir(), ".claude", "skills", "pai");
const skillfile = join(skilldir, "skill.md");
if (existssync(skillfile)) {
const content = readfilesync(skillfile, "utf-8");
const isgenerated = content.includes("generated by pai setup");
if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md."));
else {
console.log(c.yellow(" found existing skill.md (not pai-generated)."));
console.log(c.dim(" a backup will be created before overwri
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/program-CruRnLtc.mjsView on unpkg28Cross-file remote execution chain: dist/program-CruRnLtc.mjs spawns dist/daemon-mcp/index.mjs; helper contains network access plus dynamic code execution.
L28: import { fileURLToPath } from "node:url";
L29: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L30: import { createInterface } from "node:readline";
L31: import { createConnection } from "net";
L32: import { promisify } from "node:util";
...
L44: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions
L45: * /private/tmp/ops-webui dead
L46: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead
...
L272: function findProjectNotesDirs(project) {
L273: const claudeProjects = join(homedir(), ".claude", "projects"
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/program-CruRnLtc.mjsView on unpkg · L2828Trigger-reachable persistence chain: manifest.bin -> dist/cli/index.mjs -> dist/program-CruRnLtc.mjs
L28: import { fileURLToPath } from "node:url";
L29: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L30: import { createInterface } from "node:readline";
L31: import { createConnection } from "net";
L32: import { promisify } from "node:util";
...
L44: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions
L45: * /private/tmp/ops-webui dead
L46: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead
...
L272: function findProjectNotesDirs(project) {
L273: const claudeProjects = join(homedir(), ".claude", "projects");
L274: if (!existsSync(claudeProjects)) return [];
.
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/program-CruRnLtc.mjsView on unpkg · L2828import { fileURLToPath } from "node:url";
L29: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L30: import { createInterface } from "node:readline";
L31: import { createConnection } from "net";
L32: import { promisify } from "node:util";
...
L44: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions
L45: * /private/tmp/ops-webui dead
L46: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead
...
L272: function findProjectNotesDirs(project) {
L273: const claudeProjects = join(homedir(), ".claude", "projects");
L274: if (!existsSync(claudeProjects)) return [];
...
L426: console.error(err(`Invalid type "${type}". Valid: ${validTypes.join(", ")}`));
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/program-CruRnLtc.mjsView on unpkg · L28dist/daemon-mcp/index.mjsView file
145try {
L146: new Function("");
L147: return true;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/daemon-mcp/index.mjsView on unpkg · L145scripts/build-docs.mjsView file
335L336: const mod = await import(pathToFileURL(PROGRAM_MJS).href);
L337: if (typeof mod.buildProgram !== "function") {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/build-docs.mjsView on unpkg · L335dist/hooks/capture-session-summary.mjsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
rt { writefilesync, mkdirsync, existssync as existssync2, readfilesync as readfilesync2, readdirsync } from "fs";
import { join as join2 } from "path";
import { homedir } from "os";
import { resolve, join } from "path";
import { existssync, readfilesync } from "fs";
function loadenvfile() {
const possiblepaths = [
resolve(process.env.pai_dir || "", ".env"),
resolve(homedir(), ".claude", ".env")
];
for (const envpath of possiblepaths) {
if (existssync(envpath)) {
try {
const content = readfilesync(envpath, "utf-8");
for (const line of content.split("\n")) {
const trimmed = line.trim();
if (!trimmed || trimmed
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/hooks/capture-session-summary.mjsView on unpkgtab-color-command.shView file
•path = tab-color-command.sh
kind = build_helper
sizeBytes = 860
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
tab-color-command.shView on unpkgFindings
7 High6 Medium6 Low
HighChild Processdist/router-DD6D4j31.mjs
HighShelldist/program-CruRnLtc.mjs
HighCredential Redirect Persistencedist/program-CruRnLtc.mjs
HighExternal Ai Agent Control Surface Mutationdist/hooks/capture-session-summary.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/program-CruRnLtc.mjs
HighCross File Remote Execution Contextdist/program-CruRnLtc.mjs
HighTrigger Reachable Persistencedist/program-CruRnLtc.mjs
MediumDynamic Requirescripts/build-docs.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/program-CruRnLtc.mjs
MediumShips Build Helpertab-color-command.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/daemon-mcp/index.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tekmidian/pai@0.42.0.
See all versions of @tekmidian/pai for other recorded verdicts.
- Review the evidence and your use of @tekmidian/pai@0.42.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.