@tekmidian/pai@0.52.0

PAI Knowledge OS — Personal AI Infrastructure with federated memory and project management

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Static inspection found no install lifecycle hook beyond build-only prepublish behavior and no confirmed malicious chain in the reviewed runtime excerpts. The external calls inspected are consistent with Todoist operations and configured notifications.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Todoist operations, a configured notification topic, or user invocation of package commands.

Impact

No inspected source establishes credential theft, covert persistence, or another confirmed attack.

Mechanism

Todoist requests use the Todoist API; the notification hook posts its message to ntfy.sh using a configured topic. The inspected configuration and hook excerpts do not show a package install hook activating foreign agent configuration changes.

AI rationale

Network endpoints2

api.todoist.com/api/v1ntfy.sh/${topic}

Decision evidence

public snapshot

AI called this Clean at 84.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares a build-only prepublish hook and no install lifecycle hook.
The config module points to a PAI-owned config file and describes the former Claude config location as read-only during migration.
The workers config module describes the former Claude workers file as read-only during migration.
The handover cache reads Claude project transcript locations as part of its project-folder handling.
The fallback code resolves Claude settings.json as its settings target; the inspected excerpt does not show a write or its activation guards.
The capture hook resolves its data directory under the PAI namespace.
The session-summary hook resolves its data directory under the PAI namespace.
The tool-output hook resolves its data directory under the PAI namespace.

Evidence against

The package includes code that targets Claude settings and transcript-related locations, but the inspected excerpts do not establish unconsented install-time mutation.
A session notification can send a message to ntfy.sh when configured; the inspected source does not show credential forwarding.

Behavioral surface

Source & flagged code

13 flagged

dist/aibroker-client-DzkTpVjx.mjsView file

1import { t as aibrokerSocketPath } from "./runtime-paths-B0P1TvUr.mjs"; L2: import { spawnSync } from "node:child_process"; L3: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/aibroker-client-DzkTpVjx.mjsView on unpkg · L1

dist/program-ClTUv9-k.mjsView file

4405], L4406: shell: true L4407: });

High

Shell

Package source references shell execution.

dist/program-ClTUv9-k.mjsView on unpkg · L4405

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/program-ClTUv9-k.mjs: import { appendFileSync, chmodSync, copyFileSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, sta... import { createInterface } from "node:readline"; * 08 - Others/MDF/Infrastruktur/.claude/worktrees/cool-haibt 1 session * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions fragment: `${sep}.claude${sep}worktrees${sep}`, writeFileSync(join(targetPath, "Notes", "MEMORY.md"), memoryContent, "utf-8"); const claudeProjects = join(homedir(), ".claude", "projects"); writeFileSync(configPath, JSON.strin

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/program-ClTUv9-k.mjsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. l.template.md"); if (!existssync(templatepath)) { console.log(c.warn("skill template not found: " + templatepath)); console.log(c.dim(" skipping pai skill installation.")); return false; } const skilldir = join(homedir(), ".claude", "skills", "pai"); const skillfile = join(skilldir, "skill.md"); if (existssync(skillfile)) { const content = readfilesync(skillfile, "utf-8"); const isgenerated = content.includes("generated by pai setup"); if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md.")); else { console.log(c.yellow(" found existing skill.md (not pai-generated).")); console.log(c.dim(" a backup will be created before overwri

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/program-ClTUv9-k.mjsView on unpkg

29Cross-file remote execution chain: dist/program-ClTUv9-k.mjs spawns dist/daemon-mcp/index.mjs; helper contains network access plus dynamic code execution. L29: import { basename, dirname, join, relative, resolve, sep } from "node:path"; L30: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process"; L31: import chalk from "chalk"; ... L36: import { createInterface } from "node:readline"; L37: import { createConnection } from "net"; L38: import { getEncoding } from "js-tiktoken"; ... L51: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions L52: * /private/tmp/ops-webui dead L53: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead ... L279: function findProjectNotesDirs(pr

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/program-ClTUv9-k.mjsView on unpkg · L29

29Trigger-reachable persistence chain: manifest.bin -> dist/cli/index.mjs -> dist/program-ClTUv9-k.mjs L29: import { basename, dirname, join, relative, resolve, sep } from "node:path"; L30: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process"; L31: import chalk from "chalk"; ... L36: import { createInterface } from "node:readline"; L37: import { createConnection } from "net"; L38: import { getEncoding } from "js-tiktoken"; ... L51: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions L52: * /private/tmp/ops-webui dead L53: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead ... L279: function findProjectNotesDirs(project) { L280: const claudeProjects = join(homedir(),

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/program-ClTUv9-k.mjsView on unpkg · L29

29import { basename, dirname, join, relative, resolve, sep } from "node:path"; L30: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process"; L31: import chalk from "chalk"; ... L36: import { createInterface } from "node:readline"; L37: import { createConnection } from "net"; L38: import { getEncoding } from "js-tiktoken"; ... L51: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions L52: * /private/tmp/ops-webui dead L53: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead ... L279: function findProjectNotesDirs(project) { L280: const claudeProjects = join(homedir(), ".claude", "projects"); L281: if (!existsSync(claudeProjects)) return [];

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/program-ClTUv9-k.mjsView on unpkg · L29

dist/daemon-mcp/index.mjsView file

146try { L147: new Function(""); L148: return true;

High

Eval

Package source references dynamic code evaluation.

dist/daemon-mcp/index.mjsView on unpkg · L146

scripts/build-docs.mjsView file

335L336: const mod = await import(pathToFileURL(PROGRAM_MJS).href); L337: if (typeof mod.buildProgram !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/build-docs.mjsView on unpkg · L335

dist/hooks/load-project-context.mjsView file

3const require = __paiCreateRequire(import.meta.url); L4: if (!process.env.PAI_QUIET_NOTICES) process.env.PAI_QUIET_NOTICES = '1'; L5: ... L14: import { homedir as homedir5 } from "os"; L15: import { execSync } from "child_process"; L16: ... L25: import { join, dirname } from "node:path"; L26: function paiHomeDir() { L27: return process.env.PAI_HOME || join(homedir(), ".claude", "pai"); ... L38: noticesPrinted.add(newPath); L39: process.stderr.write( L40: `pai: ${old} is at an old location \u2014 run \`${migrateHint}\` to move it to ${newPath}

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/hooks/load-project-context.mjsView on unpkg · L3

dist/hooks/cleanup-session-files.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: import { existssync as existssync2, mkdirsync, readdirsync, linksync, copyfilesync } from "fs"; import { join as join2, basename } from "path"; import { homedir } from "os"; import { resolve, join } from "path"; import { existssync, readfilesync } from "fs"; function loadenvfile() { const possiblepaths = [ resolve(process.env.adapter_dir || process.env.pai_dir || "", ".env"), resolve(homedir(), ".claude", ".env") ]; for (const envpath of possiblepaths) { if (existssync(envpath)) { try { const content = readfilesync(envpath, "utf-8"); for (const line of content.split("\n")) { const trimmed = line.trim(); if (

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/hooks/cleanup-session-files.mjsView on unpkg

tab-color-command.shView file

•path = tab-color-command.sh kind = build_helper sizeBytes = 860 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tab-color-command.shView on unpkg

dist/server-R9UkCn3v.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/server-R9UkCn3v.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

13 flagged · loading source

dist/aibroker-client-DzkTpVjx.mjsView file

1import { t as aibrokerSocketPath } from "./runtime-paths-B0P1TvUr.mjs"; L2: import { spawnSync } from "node:child_process"; L3: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/aibroker-client-DzkTpVjx.mjsView on unpkg · L1

dist/program-ClTUv9-k.mjsView file

4405], L4406: shell: true L4407: });

High

Shell

Package source references shell execution.

dist/program-ClTUv9-k.mjsView on unpkg · L4405

Findings

1 Critical9 High6 Medium5 Low

CriticalCredential Exfiltrationdist/hooks/load-project-context.mjs

HighChild Processdist/aibroker-client-DzkTpVjx.mjs

HighShelldist/program-ClTUv9-k.mjs

HighEvaldist/daemon-mcp/index.mjs

HighCredential Redirect Persistencedist/program-ClTUv9-k.mjs

HighExternal Ai Agent Control Surface Mutationdist/hooks/cleanup-session-files.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/program-ClTUv9-k.mjs

HighCross File Remote Execution Contextdist/program-ClTUv9-k.mjs

HighTrigger Reachable Persistencedist/program-ClTUv9-k.mjs

HighSemantic Analysis Limiteddist/server-R9UkCn3v.mjs#virtual:normalized:round1

Affected versions and remediation

This report applies to @tekmidian/pai@0.52.0.

See all versions of @tekmidian/pai for other recorded verdicts.

Review the evidence and your use of @tekmidian/pai@0.52.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 18:28:48.545Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.