registry / @tekmidian/pai / 0.57.0
@tekmidian/pai@0.57.0
PAI Knowledge OS — Personal AI Infrastructure with federated memory and project management
AI Security Review
scanned 11d ago · by lpm-firewall-aiSource inspection supports a clean verdict: the manifest has no install-time hook, settings modification is consent-gated, and the inspected network send targets an environment-configured notification topic. Scanner labels alone did not establish credential theft or malicious agent-control mutation.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the setup flow or enables notifications by configuring NTFY_TOPIC.
Impact
No unconsented credential disclosure or malicious control-surface modification was identified.
Mechanism
Setup prompts before patching settings; notifications post a message to ntfy.sh using the configured topic.
AI rationale
Source inspection supports a clean verdict: the manifest has no install-time hook, settings modification is consent-gated, and the inspected network send targets an environment-configured notification topic. Scanner labels alone did not establish credential theft or malicious agent-control mutation.
Evidence
dist/program-COHW5ZtV.mjsdist/hooks/load-project-context.mjs
Network endpoints1
ntfy.sh
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes build-time prepublishOnly only; there is no install-time lifecycle hook.
- The settings setup asks before patching Claude settings, and merges only missing values.
- The ntfy notification sends a message to a topic supplied through NTFY_TOPIC; it does not send credential material in the inspected send code.
- The listed agent integration locations are package paths and configuration helpers; the inspected setup behavior is user-invoked.
Evidence against
- Static hints flag credential forwarding, external agent configuration writes, and dynamic evaluation, but inspected code did not substantiate a malicious chain.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
13 flagged · loading sourcedist/main-resolver-Dx-pxic1.mjsView file
8import chalk from "chalk";
L9: import { spawnSync } from "node:child_process";
L10: import { createInterface } from "node:readline";
High
Child Process
Package source references child process execution.
dist/main-resolver-Dx-pxic1.mjsView on unpkg · L8dist/program-COHW5ZtV.mjsView file
4684],
L4685: shell: true
L4686: });
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/program-COHW5ZtV.mjs:
import { appendFileSync, chmodSync, copyFileSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, sta...
import { createInterface } from "node:readline";
* 08 - Others/MDF/Infrastruktur/.claude/worktrees/cool-haibt 1 session
* 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions
fragment: `${sep}.claude${sep}worktrees${sep}`,
writeFileSync(join(targetPath, "Notes", "MEMORY.md"), memoryContent, "utf-8");
const claudeProjects = join(homedir(), ".claude", "projects");
writeFileSync(configPath, JSON.strin
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/program-COHW5ZtV.mjsView on unpkg•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
l.template.md");
if (!existssync(templatepath)) {
console.log(c.warn("skill template not found: " + templatepath));
console.log(c.dim(" skipping pai skill installation."));
return false;
}
const skilldir = join(homedir(), ".claude", "skills", "pai");
const skillfile = join(skilldir, "skill.md");
if (existssync(skillfile)) {
const content = readfilesync(skillfile, "utf-8");
const isgenerated = content.includes("generated by pai setup");
if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md."));
else {
console.log(c.yellow(" found existing skill.md (not pai-generated)."));
console.log(c.dim(" a backup will be created before overwri
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/program-COHW5ZtV.mjsView on unpkg32Cross-file remote execution chain: dist/program-COHW5ZtV.mjs spawns dist/daemon-mcp/index.mjs; helper contains network access plus dynamic code execution.
L32: import { fileURLToPath } from "node:url";
L33: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L34: import { parseDocument } from "yaml";
...
L36: import { createInterface } from "node:readline";
L37: import { createConnection } from "net";
L38: import { getEncoding } from "js-tiktoken";
...
L52: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions
L53: * /private/tmp/ops-webui dead
L54: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead
...
L303: function findProjectNotesDirs(project) {
L304: const cla
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/program-COHW5ZtV.mjsView on unpkg · L3232Trigger-reachable persistence chain: manifest.bin -> dist/cli/index.mjs -> dist/program-COHW5ZtV.mjs
L32: import { fileURLToPath } from "node:url";
L33: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L34: import { parseDocument } from "yaml";
...
L36: import { createInterface } from "node:readline";
L37: import { createConnection } from "net";
L38: import { getEncoding } from "js-tiktoken";
...
L52: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions
L53: * /private/tmp/ops-webui dead
L54: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead
...
L303: function findProjectNotesDirs(project) {
L304: const claudeProjects = join(homedir(), ".claude", "projects");
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/program-COHW5ZtV.mjsView on unpkg · L3232import { fileURLToPath } from "node:url";
L33: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L34: import { parseDocument } from "yaml";
...
L36: import { createInterface } from "node:readline";
L37: import { createConnection } from "net";
L38: import { getEncoding } from "js-tiktoken";
...
L52: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions
L53: * /private/tmp/ops-webui dead
L54: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead
...
L303: function findProjectNotesDirs(project) {
L304: const claudeProjects = join(homedir(), ".claude", "projects");
L305: if (!existsSync(claudeProjects)) return [];
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/program-COHW5ZtV.mjsView on unpkg · L32dist/daemon-mcp/index.mjsView file
146try {
L147: new Function("");
L148: return true;
High
scripts/build-docs.mjsView file
335L336: const mod = await import(pathToFileURL(PROGRAM_MJS).href);
L337: if (typeof mod.buildProgram !== "function") {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/build-docs.mjsView on unpkg · L335dist/hooks/load-project-context.mjsView file
3const require = __paiCreateRequire(import.meta.url);
L4: if (!process.env.PAI_QUIET_NOTICES) process.env.PAI_QUIET_NOTICES = '1';
L5:
...
L14: import { homedir as homedir5 } from "os";
L15: import { execSync } from "child_process";
L16:
...
L25: import { join, dirname } from "node:path";
L26: function paiHomeDir() {
L27: return process.env.PAI_HOME || join(homedir(), ".claude", "pai");
...
L38: noticesPrinted.add(newPath);
L39: process.stderr.write(
L40: `pai: ${old} is at an old location \u2014 run \`${migrateHint}\` to move it to ${newPath}
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/hooks/load-project-context.mjsView on unpkg · L3dist/hooks/cleanup-session-files.mjsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
import { existssync as existssync2, mkdirsync, readdirsync, linksync, copyfilesync } from "fs";
import { join as join2, basename } from "path";
import { homedir } from "os";
import { resolve, join } from "path";
import { existssync, readfilesync } from "fs";
function loadenvfile() {
const possiblepaths = [
resolve(process.env.adapter_dir || process.env.pai_dir || "", ".env"),
resolve(homedir(), ".claude", ".env")
];
for (const envpath of possiblepaths) {
if (existssync(envpath)) {
try {
const content = readfilesync(envpath, "utf-8");
for (const line of content.split("\n")) {
const trimmed = line.trim();
if (
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/hooks/cleanup-session-files.mjsView on unpkgtab-color-command.shView file
•path = tab-color-command.sh
kind = build_helper
sizeBytes = 860
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
tab-color-command.shView on unpkgdist/server-CGuZFOeR.mjs#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/server-CGuZFOeR.mjs#virtual:normalized:round1View on unpkgFindings
1 Critical9 High6 Medium5 Low
CriticalCredential Exfiltrationdist/hooks/load-project-context.mjs
HighChild Processdist/main-resolver-Dx-pxic1.mjs
HighShelldist/program-COHW5ZtV.mjs
HighEvaldist/daemon-mcp/index.mjs
HighCredential Redirect Persistencedist/program-COHW5ZtV.mjs
HighExternal Ai Agent Control Surface Mutationdist/hooks/cleanup-session-files.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/program-COHW5ZtV.mjs
HighCross File Remote Execution Contextdist/program-COHW5ZtV.mjs
HighTrigger Reachable Persistencedist/program-COHW5ZtV.mjs
HighSemantic Analysis Limiteddist/server-CGuZFOeR.mjs#virtual:normalized:round1
MediumDynamic Requirescripts/build-docs.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/program-COHW5ZtV.mjs
MediumShips Build Helpertab-color-command.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tekmidian/pai@0.57.0.
See all versions of @tekmidian/pai for other recorded verdicts.
- Review the evidence and your use of @tekmidian/pai@0.57.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.