registry / @tekmidian/pai / 0.53.1
@tekmidian/pai@0.53.1
PAI Knowledge OS — Personal AI Infrastructure with federated memory and project management
AI Security Review
scanned 11d ago · by lpm-firewall-aiSource inspection found no install-time attack or concrete malicious behavior in the required flagged paths. The available excerpts support ordinary user-invoked configuration and consent-gated behavior, so the scanner labels alone do not justify a warning or block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
No malicious trigger was established; the reviewed behaviors are reached through CLI, hook, or notification use.
Impact
No unauthorized credential disclosure or agent-control mutation was established from the inspected excerpts.
Mechanism
The inspected excerpts show local configuration path resolution, an explicit prompt before adopting an environment token, and notifications requiring a configured topic.
AI rationale
Source inspection found no install-time attack or concrete malicious behavior in the required flagged paths. The available excerpts support ordinary user-invoked configuration and consent-gated behavior, so the scanner labels alone do not justify a warning or block.
Evidence
package.jsondist/config-B3EPzRjf.mjsdist/config-Bn9jpblO.mjsdist/context-handover-cache-CXyH6QsC.mjsdist/fallback-CPfyTSTx.mjsdist/hooks/capture-all-events.mjsdist/hooks/capture-session-summary.mjsdist/hooks/capture-tool-output.mjsdist/hooks/context-compression-hook.mjsdist/aibroker-client-DzkTpVjx.mjsdist/program-DdCumNTx.mjsdist/daemon-mcp/index.mjsdist/hooks/load-project-context.mjsdist/hooks/cleanup-session-files.mjsdist/server-CGiHdaUp.mjs
Network endpoints1
ntfy.sh
Decision evidence
public snapshotAI called this Clean at 76.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares only a prepublishOnly build script; it has no preinstall, install, or postinstall hook.
- The flagged config and hook excerpts resolve PAI and Claude configuration paths, including legacy read locations; they do not establish an unconsented external control-surface write.
- The flagged worker configuration excerpts describe migration, fallback notes, and project transcript paths; they do not establish a malicious configuration change.
- The Todoist setup asks before using TODOIST_API_KEY from the environment; the flagged ntfy notification code requires a configured topic.
- The daemon MCP entry imports package configuration and worker operations; the inspected excerpt does not show dynamic evaluation or an attack.
- The inspected environment-loading code reads .env files from PAI-related paths; the excerpt does not show credential transmission.
Evidence against
- The package contains CLI and hook code that reads local configuration and invokes child processes, but the inspected excerpts do not establish malicious use.
- The scanner’s gateway and credential labels are not substantiated by the inspected source excerpts.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
13 flagged · loading sourcedist/aibroker-client-DzkTpVjx.mjsView file
1import { t as aibrokerSocketPath } from "./runtime-paths-B0P1TvUr.mjs";
L2: import { spawnSync } from "node:child_process";
L3: import { randomUUID } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/aibroker-client-DzkTpVjx.mjsView on unpkg · L1dist/program-DdCumNTx.mjsView file
4405],
L4406: shell: true
L4407: });
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/program-DdCumNTx.mjs:
import { appendFileSync, chmodSync, copyFileSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, sta...
import { createInterface } from "node:readline";
* 08 - Others/MDF/Infrastruktur/.claude/worktrees/cool-haibt 1 session
* 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions
fragment: `${sep}.claude${sep}worktrees${sep}`,
writeFileSync(join(targetPath, "Notes", "MEMORY.md"), memoryContent, "utf-8");
const claudeProjects = join(homedir(), ".claude", "projects");
writeFileSync(configPath, JSON.strin
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/program-DdCumNTx.mjsView on unpkg•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
l.template.md");
if (!existssync(templatepath)) {
console.log(c.warn("skill template not found: " + templatepath));
console.log(c.dim(" skipping pai skill installation."));
return false;
}
const skilldir = join(homedir(), ".claude", "skills", "pai");
const skillfile = join(skilldir, "skill.md");
if (existssync(skillfile)) {
const content = readfilesync(skillfile, "utf-8");
const isgenerated = content.includes("generated by pai setup");
if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md."));
else {
console.log(c.yellow(" found existing skill.md (not pai-generated)."));
console.log(c.dim(" a backup will be created before overwri
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/program-DdCumNTx.mjsView on unpkg29Cross-file remote execution chain: dist/program-DdCumNTx.mjs spawns dist/daemon-mcp/index.mjs; helper contains network access plus dynamic code execution.
L29: import { basename, dirname, join, relative, resolve, sep } from "node:path";
L30: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L31: import chalk from "chalk";
...
L36: import { createInterface } from "node:readline";
L37: import { createConnection } from "net";
L38: import { getEncoding } from "js-tiktoken";
...
L51: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions
L52: * /private/tmp/ops-webui dead
L53: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead
...
L279: function findProjectNotesDirs(pr
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/program-DdCumNTx.mjsView on unpkg · L2929Trigger-reachable persistence chain: manifest.bin -> dist/cli/index.mjs -> dist/program-DdCumNTx.mjs
L29: import { basename, dirname, join, relative, resolve, sep } from "node:path";
L30: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L31: import chalk from "chalk";
...
L36: import { createInterface } from "node:readline";
L37: import { createConnection } from "net";
L38: import { getEncoding } from "js-tiktoken";
...
L51: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions
L52: * /private/tmp/ops-webui dead
L53: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead
...
L279: function findProjectNotesDirs(project) {
L280: const claudeProjects = join(homedir(),
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/program-DdCumNTx.mjsView on unpkg · L2929import { basename, dirname, join, relative, resolve, sep } from "node:path";
L30: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L31: import chalk from "chalk";
...
L36: import { createInterface } from "node:readline";
L37: import { createConnection } from "net";
L38: import { getEncoding } from "js-tiktoken";
...
L51: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions
L52: * /private/tmp/ops-webui dead
L53: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead
...
L279: function findProjectNotesDirs(project) {
L280: const claudeProjects = join(homedir(), ".claude", "projects");
L281: if (!existsSync(claudeProjects)) return [];
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/program-DdCumNTx.mjsView on unpkg · L29dist/daemon-mcp/index.mjsView file
146try {
L147: new Function("");
L148: return true;
High
scripts/build-docs.mjsView file
335L336: const mod = await import(pathToFileURL(PROGRAM_MJS).href);
L337: if (typeof mod.buildProgram !== "function") {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/build-docs.mjsView on unpkg · L335dist/hooks/load-project-context.mjsView file
3const require = __paiCreateRequire(import.meta.url);
L4: if (!process.env.PAI_QUIET_NOTICES) process.env.PAI_QUIET_NOTICES = '1';
L5:
...
L14: import { homedir as homedir5 } from "os";
L15: import { execSync } from "child_process";
L16:
...
L25: import { join, dirname } from "node:path";
L26: function paiHomeDir() {
L27: return process.env.PAI_HOME || join(homedir(), ".claude", "pai");
...
L38: noticesPrinted.add(newPath);
L39: process.stderr.write(
L40: `pai: ${old} is at an old location \u2014 run \`${migrateHint}\` to move it to ${newPath}
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/hooks/load-project-context.mjsView on unpkg · L3dist/hooks/cleanup-session-files.mjsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
import { existssync as existssync2, mkdirsync, readdirsync, linksync, copyfilesync } from "fs";
import { join as join2, basename } from "path";
import { homedir } from "os";
import { resolve, join } from "path";
import { existssync, readfilesync } from "fs";
function loadenvfile() {
const possiblepaths = [
resolve(process.env.adapter_dir || process.env.pai_dir || "", ".env"),
resolve(homedir(), ".claude", ".env")
];
for (const envpath of possiblepaths) {
if (existssync(envpath)) {
try {
const content = readfilesync(envpath, "utf-8");
for (const line of content.split("\n")) {
const trimmed = line.trim();
if (
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/hooks/cleanup-session-files.mjsView on unpkgtab-color-command.shView file
•path = tab-color-command.sh
kind = build_helper
sizeBytes = 860
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
tab-color-command.shView on unpkgdist/server-CGiHdaUp.mjs#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/server-CGiHdaUp.mjs#virtual:normalized:round1View on unpkgFindings
1 Critical9 High6 Medium5 Low
CriticalCredential Exfiltrationdist/hooks/load-project-context.mjs
HighChild Processdist/aibroker-client-DzkTpVjx.mjs
HighShelldist/program-DdCumNTx.mjs
HighEvaldist/daemon-mcp/index.mjs
HighCredential Redirect Persistencedist/program-DdCumNTx.mjs
HighExternal Ai Agent Control Surface Mutationdist/hooks/cleanup-session-files.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/program-DdCumNTx.mjs
HighCross File Remote Execution Contextdist/program-DdCumNTx.mjs
HighTrigger Reachable Persistencedist/program-DdCumNTx.mjs
HighSemantic Analysis Limiteddist/server-CGiHdaUp.mjs#virtual:normalized:round1
MediumDynamic Requirescripts/build-docs.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/program-DdCumNTx.mjs
MediumShips Build Helpertab-color-command.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tekmidian/pai@0.53.1.
See all versions of @tekmidian/pai for other recorded verdicts.
- Review the evidence and your use of @tekmidian/pai@0.53.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.