@tekmidian/pai@0.54.0

PAI Knowledge OS — Personal AI Infrastructure with federated memory and project management

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Source inspection found no malicious behavior: package.json has no install hook, the notification endpoint is opt-in via NTFY_TOPIC, and the credential audit does not transmit credentials. The remaining configuration and project registration behavior is consistent with the package’s CLI features.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

No install-time trigger is present; the inspected notification path runs during a project-context hook when NTFY_TOPIC is configured.

Impact

No credential theft or malicious agent-control mutation was established from the inspected source.

Mechanism

The hook posts a notification to ntfy.sh using the configured topic. Credential-related code audits process settings and records token presence without transmitting the token.

AI rationale

Evidence

package.jsondist/hooks/load-project-context.mjsdist/program-DYux0CW2.mjs

Network endpoints1

ntfy.sh

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json has no install lifecycle hook; prepublishOnly runs a build.
The flagged hook sends notifications to ntfy.sh only when NTFY_TOPIC is set, and skips them otherwise.
The credential audit inspects live Claude process settings and records token presence; it does not send credentials.
The dynamic Function call is an empty syntax capability check.
The reviewed agent-related paths resolve PAI data, config, project, or log locations; no malicious control-surface write was established.

Evidence against

The project-context hook can auto-register a detected project when project signals exist, and process environment is passed to the PAI CLI.
The package includes code that reads a local .env file into process.env.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStrings

Source & flagged code

13 flagged

dist/aibroker-client-DzkTpVjx.mjsView file

Lines 1-21javascript

1import { t as aibrokerSocketPath } from "./runtime-paths-B0P1TvUr.mjs";

2import { spawnSync } from "node:child_process";

3import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/aibroker-client-DzkTpVjx.mjsView on unpkg · L1

4import { connect } from "node:net";

6//#region src/cli/lib/aibroker-client.ts

7/**

8* aibroker-client.ts — Lightweight IPC client for AIBroker daemon.

10* Connects to the AIBroker Unix Domain Socket, sends a JSON-RPC request,

11* and reads a single newline-terminated JSON response. No class needed —

12* just a thin async function matching the WatcherClient protocol.

13*

14* Socket path: /tmp/aibroker.sock (default; override via AIBROKER_SOCKET env).

15*/

16const DEFAULT_SOCKET = process.env.AIBROKER_SOCKET ?? aibrokerSocketPath();

17/**

18* How long to wait for `send_to_session`, which must exceed the server's own

19* ack window or the caller gives up while the callee is still working.

20*

21* AIBroker waits up to SEND_ACK_TIMEOUT_MS (15s) for the submit confirmation —

dist/program-DYux0CW2.mjsView file

4405], L4406: shell: true L4407: });

High

Shell

Package source references shell execution.

dist/program-DYux0CW2.mjsView on unpkg · L4405

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/program-DYux0CW2.mjs: import { appendFileSync, chmodSync, copyFileSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, sta... import { createInterface } from "node:readline"; * 08 - Others/MDF/Infrastruktur/.claude/worktrees/cool-haibt 1 session * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions fragment: `${sep}.claude${sep}worktrees${sep}`, writeFileSync(join(targetPath, "Notes", "MEMORY.md"), memoryContent, "utf-8"); const claudeProjects = join(homedir(), ".claude", "projects"); writeFileSync(configPath, JSON.strin

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/program-DYux0CW2.mjsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. l.template.md"); if (!existssync(templatepath)) { console.log(c.warn("skill template not found: " + templatepath)); console.log(c.dim(" skipping pai skill installation.")); return false; } const skilldir = join(homedir(), ".claude", "skills", "pai"); const skillfile = join(skilldir, "skill.md"); if (existssync(skillfile)) { const content = readfilesync(skillfile, "utf-8"); const isgenerated = content.includes("generated by pai setup"); if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md.")); else { console.log(c.yellow(" found existing skill.md (not pai-generated).")); console.log(c.dim(" a backup will be created before overwri

dist/daemon-mcp/index.mjsView file

Lines 126-166javascript

126 configurable: true

127 });

128}

129function mergeDefs(...defs) {

130 const mergedDescriptors = {};

131

scripts/build-docs.mjsView file

Lines 315-355javascript

315

316 out.push("## All commands", "");

317 out.push("| Command | Description |", "|---------|-------------|");

318 for (const c of flat) {

dist/hooks/load-project-context.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { createRequire as __paiCreateRequire } from 'node:module';

3const require = __paiCreateRequire(import.meta.url);

4if (!

dist/hooks/cleanup-session-files.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: import { existssync as existssync2, mkdirsync, readdirsync, linksync, copyfilesync } from "fs"; import { join as join2, basename } from "path"; import { homedir } from "os"; import { resolve, join } from "path"; import { existssync, readfilesync } from "fs"; function loadenvfile() { const possiblepaths = [ resolve(process.env.adapter_dir || process.env.pai_dir || "", ".env"), resolve(homedir(), ".claude", ".env") ]; for (const envpath of possiblepaths) { if (existssync(envpath)) { try { const content = readfilesync(envpath, "utf-8"); for (const line of content.split("\n")) { const trimmed = line.trim(); if (

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/hooks/cleanup-session-files.mjsView on unpkg

tab-color-command.shView file

•path = tab-color-command.sh kind = build_helper sizeBytes = 860 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tab-color-command.shView on unpkg

dist/server-CGiHdaUp.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/server-CGiHdaUp.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

13 flagged · loading source

dist/aibroker-client-DzkTpVjx.mjsView file

1import { t as aibrokerSocketPath } from "./runtime-paths-B0P1TvUr.mjs"; L2: import { spawnSync } from "node:child_process"; L3: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/aibroker-client-DzkTpVjx.mjsView on unpkg · L1

dist/program-DYux0CW2.mjsView file

4405], L4406: shell: true L4407: });

High

Shell

Package source references shell execution.

dist/program-DYux0CW2.mjsView on unpkg · L4405

Findings

1 Critical9 High6 Medium5 Low

CriticalCredential Exfiltrationdist/hooks/load-project-context.mjs

HighChild Processdist/aibroker-client-DzkTpVjx.mjs

HighShelldist/program-DYux0CW2.mjs

HighEvaldist/daemon-mcp/index.mjs

HighCredential Redirect Persistencedist/program-DYux0CW2.mjs

HighExternal Ai Agent Control Surface Mutationdist/hooks/cleanup-session-files.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/program-DYux0CW2.mjs

HighCross File Remote Execution Contextdist/program-DYux0CW2.mjs

HighTrigger Reachable Persistencedist/program-DYux0CW2.mjs

HighSemantic Analysis Limiteddist/server-CGiHdaUp.mjs#virtual:normalized:round1

Affected versions and remediation

This report applies to @tekmidian/pai@0.54.0.

See all versions of @tekmidian/pai for other recorded verdicts.

Review the evidence and your use of @tekmidian/pai@0.54.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 18:28:07.169Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.