registry / @tekmidian/pai / 0.42.4
@tekmidian/pai@0.42.4
PAI Knowledge OS — Personal AI Infrastructure with federated memory and project management
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe manifest has no automatic install lifecycle hook, and the agent configuration changes are reached through prompted CLI setup. The static credential and agent-mutation hints are not supported as attacks by the inspected source behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the PAI setup or configures an enabled notification channel.
Impact
The inspected behavior supports user-configured PAI functionality; no unconsented credential disclosure or install-time agent mutation was established.
Mechanism
Setup prompts before modifying agent settings; notifications post their message to the configured URL only when enabled.
AI rationale
The manifest has no automatic install lifecycle hook, and the agent configuration changes are reached through prompted CLI setup. The static credential and agent-mutation hints are not supported as attacks by the inspected source behavior.
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI and lists only a prepublishOnly build hook, with no install-time hook.
- Agent settings and hook installation are part of explicit setup steps; the settings patch asks before writing and preserves existing values.
- Hook files read local configuration or session data for PAI operations; inspected excerpts show no outbound credential transfer.
- The inspected notification code sends only when the user enables a channel and supplies its URL.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
11 flagged · loading sourcedist/router-DD6D4j31.mjsView file
2import { connect } from "node:net";
L3: import { spawn } from "node:child_process";
L4:
High
Child Process
Package source references child process execution.
dist/router-DD6D4j31.mjsView on unpkg · L2dist/program-zpoYnJGz.mjsView file
3803],
L3804: shell: true
L3805: });
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/program-zpoYnJGz.mjs:
import { appendFileSync, chmodSync, copyFileSync, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, statSync, s...
import { createInterface } from "node:readline";
* 08 - Others/MDF/Infrastruktur/.claude/worktrees/cool-haibt 1 session
* 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions
fragment: `${sep}.claude${sep}worktrees${sep}`,
writeFileSync(join(targetPath, "Notes", "MEMORY.md"), memoryContent, "utf-8");
const claudeProjects = join(homedir(), ".claude", "projects");
writeFileSync(configPath, JSON.strin
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/program-zpoYnJGz.mjsView on unpkg•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
l.template.md");
if (!existssync(templatepath)) {
console.log(c.warn("skill template not found: " + templatepath));
console.log(c.dim(" skipping pai skill installation."));
return false;
}
const skilldir = join(homedir(), ".claude", "skills", "pai");
const skillfile = join(skilldir, "skill.md");
if (existssync(skillfile)) {
const content = readfilesync(skillfile, "utf-8");
const isgenerated = content.includes("generated by pai setup");
if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md."));
else {
console.log(c.yellow(" found existing skill.md (not pai-generated)."));
console.log(c.dim(" a backup will be created before overwri
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/program-zpoYnJGz.mjsView on unpkg28Cross-file remote execution chain: dist/program-zpoYnJGz.mjs spawns dist/daemon-mcp/index.mjs; helper contains network access plus dynamic code execution.
L28: import { fileURLToPath } from "node:url";
L29: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L30: import { createInterface } from "node:readline";
L31: import { createConnection } from "net";
L32: import { promisify } from "node:util";
...
L44: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions
L45: * /private/tmp/ops-webui dead
L46: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead
...
L272: function findProjectNotesDirs(project) {
L273: const claudeProjects = join(homedir(), ".claude", "projects"
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/program-zpoYnJGz.mjsView on unpkg · L2828Trigger-reachable persistence chain: manifest.bin -> dist/cli/index.mjs -> dist/program-zpoYnJGz.mjs
L28: import { fileURLToPath } from "node:url";
L29: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L30: import { createInterface } from "node:readline";
L31: import { createConnection } from "net";
L32: import { promisify } from "node:util";
...
L44: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions
L45: * /private/tmp/ops-webui dead
L46: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead
...
L272: function findProjectNotesDirs(project) {
L273: const claudeProjects = join(homedir(), ".claude", "projects");
L274: if (!existsSync(claudeProjects)) return [];
.
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/program-zpoYnJGz.mjsView on unpkg · L2828import { fileURLToPath } from "node:url";
L29: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L30: import { createInterface } from "node:readline";
L31: import { createConnection } from "net";
L32: import { promisify } from "node:util";
...
L44: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions
L45: * /private/tmp/ops-webui dead
L46: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead
...
L272: function findProjectNotesDirs(project) {
L273: const claudeProjects = join(homedir(), ".claude", "projects");
L274: if (!existsSync(claudeProjects)) return [];
...
L426: console.error(err(`Invalid type "${type}". Valid: ${validTypes.join(", ")}`));
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/program-zpoYnJGz.mjsView on unpkg · L28dist/daemon-mcp/index.mjsView file
145try {
L146: new Function("");
L147: return true;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/daemon-mcp/index.mjsView on unpkg · L145scripts/build-docs.mjsView file
335L336: const mod = await import(pathToFileURL(PROGRAM_MJS).href);
L337: if (typeof mod.buildProgram !== "function") {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/build-docs.mjsView on unpkg · L335dist/hooks/capture-session-summary.mjsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
rt { writefilesync, mkdirsync, existssync as existssync2, readfilesync as readfilesync2, readdirsync } from "fs";
import { join as join2 } from "path";
import { homedir } from "os";
import { resolve, join } from "path";
import { existssync, readfilesync } from "fs";
function loadenvfile() {
const possiblepaths = [
resolve(process.env.pai_dir || "", ".env"),
resolve(homedir(), ".claude", ".env")
];
for (const envpath of possiblepaths) {
if (existssync(envpath)) {
try {
const content = readfilesync(envpath, "utf-8");
for (const line of content.split("\n")) {
const trimmed = line.trim();
if (!trimmed || trimmed
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/hooks/capture-session-summary.mjsView on unpkgtab-color-command.shView file
•path = tab-color-command.sh
kind = build_helper
sizeBytes = 860
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
tab-color-command.shView on unpkgFindings
7 High6 Medium6 Low
HighChild Processdist/router-DD6D4j31.mjs
HighShelldist/program-zpoYnJGz.mjs
HighCredential Redirect Persistencedist/program-zpoYnJGz.mjs
HighExternal Ai Agent Control Surface Mutationdist/hooks/capture-session-summary.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/program-zpoYnJGz.mjs
HighCross File Remote Execution Contextdist/program-zpoYnJGz.mjs
HighTrigger Reachable Persistencedist/program-zpoYnJGz.mjs
MediumDynamic Requirescripts/build-docs.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/program-zpoYnJGz.mjs
MediumShips Build Helpertab-color-command.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/daemon-mcp/index.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tekmidian/pai@0.42.4.
See all versions of @tekmidian/pai for other recorded verdicts.
- Review the evidence and your use of @tekmidian/pai@0.42.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.