@tekmidian/pai@0.51.1

PAI Knowledge OS — Personal AI Infrastructure with federated memory and project management

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Inspected source does not substantiate the scanner’s credential exfiltration or fixed-gateway claims. The notification is user-configured and no concrete malicious behavior was established.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A notification runs while the hook is active and NTFY_TOPIC is set.

Impact

The topic operator can receive the notification message. The inspected behavior does not establish credential theft or malicious control-surface modification.

Mechanism

The hook posts the notification message to the topic-specific ntfy.sh URL; the inspected code does not send credentials.

AI rationale

Inspected source does not substantiate the scanner’s credential exfiltration or fixed-gateway claims. The notification is user-configured and no concrete malicious behavior was established.

Evidence

dist/hooks/load-project-context.mjs

Network endpoints1

ntfy.sh

Decision evidence

public snapshot

AI called this Clean at 76.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes the package through its CLI and library entrypoints; its only publish hook builds the package.
Agent integration files use PAI-owned configuration and project paths; the inspected locations show no foreign agent control-surface write.
The inspected notification code sends a message to ntfy.sh only when the user supplies NTFY_TOPIC; it does not show credential forwarding.
The flagged token audit examines process arguments to identify proxy configuration; its inspected section does not transmit credentials.

Evidence against

The load-project-context hook sends notification message text to the configured ntfy topic, which can expose that message to whoever controls the topic.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

13 flagged

dist/router-DBAZfE7X.mjsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/router-DBAZfE7X.mjsView on unpkg · L1

3import { connect } from "node:net";

5//#region src/notifications/providers/ntfy.ts

6var NtfyProvider = class {

7 channelId = "ntfy";

8 async send(payload, config) {

9 const cfg = config.channels.ntfy;

10 if (!cfg.enabled || !cfg.url) return false;

11 try {

12 const headers = { "Content-Type": "text/plain; charset=utf-8" };

13 if (payload.title) headers["Title"] = payload.title;

14 if (cfg.priority && cfg.priority !== "default") headers["Priority"] = cfg.priority;

15 return (await fetch(cfg.url, {

16 method: "POST",

17 headers,

18 body: payload.message

19 })).ok;

20 } catch {

21 return false;

dist/program-BQaDYGNC.mjsView file

4405], L4406: shell: true L4407: });

High

Shell

Package source references shell execution.

dist/program-BQaDYGNC.mjsView on unpkg · L4405

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/program-BQaDYGNC.mjs: import { appendFileSync, chmodSync, copyFileSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, sta... import { createInterface } from "node:readline"; * 08 - Others/MDF/Infrastruktur/.claude/worktrees/cool-haibt 1 session * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions fragment: `${sep}.claude${sep}worktrees${sep}`, writeFileSync(join(targetPath, "Notes", "MEMORY.md"), memoryContent, "utf-8"); const claudeProjects = join(homedir(), ".claude", "projects"); writeFileSync(configPath, JSON.strin

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/program-BQaDYGNC.mjsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. l.template.md"); if (!existssync(templatepath)) { console.log(c.warn("skill template not found: " + templatepath)); console.log(c.dim(" skipping pai skill installation.")); return false; } const skilldir = join(homedir(), ".claude", "skills", "pai"); const skillfile = join(skilldir, "skill.md"); if (existssync(skillfile)) { const content = readfilesync(skillfile, "utf-8"); const isgenerated = content.includes("generated by pai setup"); if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md.")); else { console.log(c.yellow(" found existing skill.md (not pai-generated).")); console.log(c.dim(" a backup will be created before overwri

dist/daemon-mcp/index.mjsView file

Lines 126-166javascript

126 configurable: true

127 });

128}

129function mergeDefs(...defs) {

130 const mergedDescriptors = {};

131

scripts/build-docs.mjsView file

Lines 315-355javascript

315

316 out.push("## All commands", "");

317 out.push("| Command | Description |", "|---------|-------------|");

318 for (const c of flat) {

dist/hooks/load-project-context.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { createRequire as __paiCreateRequire } from 'node:module';

3const require = __paiCreateRequire(import.meta.url);

4if (!

dist/hooks/cleanup-session-files.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: import { existssync as existssync2, mkdirsync, readdirsync, linksync, copyfilesync } from "fs"; import { join as join2, basename } from "path"; import { homedir } from "os"; import { resolve, join } from "path"; import { existssync, readfilesync } from "fs"; function loadenvfile() { const possiblepaths = [ resolve(process.env.adapter_dir || process.env.pai_dir || "", ".env"), resolve(homedir(), ".claude", ".env") ]; for (const envpath of possiblepaths) { if (existssync(envpath)) { try { const content = readfilesync(envpath, "utf-8"); for (const line of content.split("\n")) { const trimmed = line.trim(); if (

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/hooks/cleanup-session-files.mjsView on unpkg

tab-color-command.shView file

•path = tab-color-command.sh kind = build_helper sizeBytes = 860 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tab-color-command.shView on unpkg

dist/server-R9UkCn3v.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/server-R9UkCn3v.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

13 flagged · loading source

dist/router-DBAZfE7X.mjsView file

1import { spawn } from "node:child_process"; L2: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/router-DBAZfE7X.mjsView on unpkg · L1

dist/program-BQaDYGNC.mjsView file

4405], L4406: shell: true L4407: });

High

Shell

Package source references shell execution.

dist/program-BQaDYGNC.mjsView on unpkg · L4405

Findings

1 Critical9 High6 Medium5 Low

CriticalCredential Exfiltrationdist/hooks/load-project-context.mjs

HighChild Processdist/router-DBAZfE7X.mjs

HighShelldist/program-BQaDYGNC.mjs

HighEvaldist/daemon-mcp/index.mjs

HighCredential Redirect Persistencedist/program-BQaDYGNC.mjs

HighExternal Ai Agent Control Surface Mutationdist/hooks/cleanup-session-files.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/program-BQaDYGNC.mjs

HighCross File Remote Execution Contextdist/program-BQaDYGNC.mjs

HighTrigger Reachable Persistencedist/program-BQaDYGNC.mjs

HighSemantic Analysis Limiteddist/server-R9UkCn3v.mjs#virtual:normalized:round1

Affected versions and remediation

This report applies to @tekmidian/pai@0.51.1.

See all versions of @tekmidian/pai for other recorded verdicts.

Review the evidence and your use of @tekmidian/pai@0.51.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 18:27:41.428Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.