@tekmidian/pai@0.66.1

PAI Knowledge OS — Personal AI Infrastructure with federated memory and project management

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The flagged configuration writes are part of an explicitly prompted CLI setup, and the notification path requires an environment-provided topic. Source inspection found no confirmed credential theft, covert agent-control mutation, or install-time attack; the scanner hints do not establish malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user runs the CLI setup or enables a notification topic in the environment.

Impact

No confirmed attack surface was established.

Mechanism

Setup asks before modifying Claude settings; notification code posts a supplied message only when its topic is configured.

AI rationale

Network endpoints1

ntfy.sh

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package has no preinstall, install, or postinstall hook; its prepublish-only script builds and runs a worker command.
The settings patch is gated by an interactive prompt, and its description identifies PAI hooks and settings.
The flagged project-context hook sends notifications only when a notification topic is supplied through the environment; it posts the message to the notification service.
The remaining flagged configuration locations are PAI home paths, project transcript paths, or hook environment-file loading; they do not establish an attack.
The server and daemon entrypoints import worker configuration and process-handling modules; the inspected excerpts do not show dynamic evaluation or credential exfiltration.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

Source & flagged code

13 flagged

dist/server-DgmAHyFK.mjsView file

5import { fileURLToPath } from "node:url"; L6: import { execFileSync, spawn } from "node:child_process"; L7: import { connect } from "node:net";

High

Child Process

Package source references child process execution.

dist/server-DgmAHyFK.mjsView on unpkg · L5

dist/program-JJ0TwSHI.mjsView file

10489const result = spawnSync(command, { L10490: shell: true, L10491: cwd,

High

Shell

Package source references shell execution.

dist/program-JJ0TwSHI.mjsView on unpkg · L10489

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/program-JJ0TwSHI.mjs: import { appendFileSync, chmodSync, closeSync, copyFileSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, readlinkSync, realpath... import { createInterface } from "node:readline"; * 08 - Others/MDF/Infrastruktur/.claude/worktrees/cool-haibt 1 session * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions fragment: `${sep}.claude${sep}worktrees${sep}`, writeFileSync(join(targetPath, "Notes", "MEMORY.md"), memoryContent, "utf-8"); const claudeProjects = join(homedir(), ".claude", "projects"); writeFileSync(configPath, JSON.strin

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/program-JJ0TwSHI.mjsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. l.template.md"); if (!existssync(templatepath)) { console.log(c.warn("skill template not found: " + templatepath)); console.log(c.dim(" skipping pai skill installation.")); return false; } const skilldir = join(homedir(), ".claude", "skills", "pai"); const skillfile = join(skilldir, "skill.md"); if (existssync(skillfile)) { const content = readfilesync(skillfile, "utf-8"); const isgenerated = content.includes("generated by pai setup"); if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md.")); else { console.log(c.yellow(" found existing skill.md (not pai-generated).")); console.log(c.dim(" a backup will be created before overwri

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/program-JJ0TwSHI.mjsView on unpkg

33Cross-file remote execution chain: dist/program-JJ0TwSHI.mjs spawns dist/daemon-mcp/index.mjs; helper contains network access plus dynamic code execution. L33: import { fileURLToPath } from "node:url"; L34: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process"; L35: import { parseDocument } from "yaml"; ... L37: import { createInterface } from "node:readline"; L38: import { createConnection } from "net"; L39: import { getEncoding } from "js-tiktoken"; ... L53: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions L54: * /private/tmp/ops-webui dead L55: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead ... L304: function findProjectNotesDirs(project) { L305: const cla

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/program-JJ0TwSHI.mjsView on unpkg · L33

33Trigger-reachable persistence chain: manifest.bin -> dist/cli/index.mjs -> dist/program-JJ0TwSHI.mjs L33: import { fileURLToPath } from "node:url"; L34: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process"; L35: import { parseDocument } from "yaml"; ... L37: import { createInterface } from "node:readline"; L38: import { createConnection } from "net"; L39: import { getEncoding } from "js-tiktoken"; ... L53: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions L54: * /private/tmp/ops-webui dead L55: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead ... L304: function findProjectNotesDirs(project) { L305: const claudeProjects = join(homedir(), ".claude", "projects");

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/program-JJ0TwSHI.mjsView on unpkg · L33

33import { fileURLToPath } from "node:url"; L34: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process"; L35: import { parseDocument } from "yaml"; ... L37: import { createInterface } from "node:readline"; L38: import { createConnection } from "net"; L39: import { getEncoding } from "js-tiktoken"; ... L53: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions L54: * /private/tmp/ops-webui dead L55: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead ... L304: function findProjectNotesDirs(project) { L305: const claudeProjects = join(homedir(), ".claude", "projects"); L306: if (!existsSync(claudeProjects)) return [];

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/program-JJ0TwSHI.mjsView on unpkg · L33

dist/daemon-mcp/index.mjsView file

147try { L148: new Function(""); L149: return true;

High

Eval

Package source references dynamic code evaluation.

dist/daemon-mcp/index.mjsView on unpkg · L147

scripts/build-docs.mjsView file

335L336: const mod = await import(pathToFileURL(PROGRAM_MJS).href); L337: if (typeof mod.buildProgram !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/build-docs.mjsView on unpkg · L335

dist/hooks/load-project-context.mjsView file

3const require = __paiCreateRequire(import.meta.url); L4: if (!process.env.PAI_QUIET_NOTICES) process.env.PAI_QUIET_NOTICES = '1'; L5: var __create = Object.create; ... L2609: if (typeof node_buffer.Buffer === "function") { L2610: return node_buffer.Buffer.from(src, "base64"); L2611: } else if (typeof atob === "function") { ... L5223: yield* this.next(token); L5224: yield* this.end(forceDoc, endOffset); L5225: } ... L7429: import { join, dirname } from "node:path"; L7430: function paiHomeDir() { L7431: return process.env.PAI_HOME || join(homedir(), ".claude", "pai");

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/hooks/load-project-context.mjsView on unpkg · L3

dist/hooks/cleanup-session-files.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: import { existssync as existssync2, mkdirsync, readdirsync, linksync, copyfilesync } from "fs"; import { join as join2, basename } from "path"; import { homedir } from "os"; import { resolve, join } from "path"; import { existssync, readfilesync } from "fs"; function loadenvfile() { const possiblepaths = [ resolve(process.env.adapter_dir || process.env.pai_dir || "", ".env"), resolve(homedir(), ".claude", ".env") ]; for (const envpath of possiblepaths) { if (existssync(envpath)) { try { const content = readfilesync(envpath, "utf-8"); for (const line of content.split("\n")) { const trimmed = line.trim(); if (

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/hooks/cleanup-session-files.mjsView on unpkg

tab-color-command.shView file

•path = tab-color-command.sh kind = build_helper sizeBytes = 860 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tab-color-command.shView on unpkg

dist/server-DgmAHyFK.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/server-DgmAHyFK.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

13 flagged · loading source

dist/server-DgmAHyFK.mjsView file

5import { fileURLToPath } from "node:url"; L6: import { execFileSync, spawn } from "node:child_process"; L7: import { connect } from "node:net";

High

Child Process

Package source references child process execution.

dist/server-DgmAHyFK.mjsView on unpkg · L5

dist/program-JJ0TwSHI.mjsView file

10489const result = spawnSync(command, { L10490: shell: true, L10491: cwd,

High

Shell

Package source references shell execution.

dist/program-JJ0TwSHI.mjsView on unpkg · L10489

Findings

1 Critical9 High6 Medium5 Low

CriticalCredential Exfiltrationdist/hooks/load-project-context.mjs

HighChild Processdist/server-DgmAHyFK.mjs

HighShelldist/program-JJ0TwSHI.mjs

HighEvaldist/daemon-mcp/index.mjs

HighCredential Redirect Persistencedist/program-JJ0TwSHI.mjs

HighExternal Ai Agent Control Surface Mutationdist/hooks/cleanup-session-files.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/program-JJ0TwSHI.mjs

HighCross File Remote Execution Contextdist/program-JJ0TwSHI.mjs

HighTrigger Reachable Persistencedist/program-JJ0TwSHI.mjs

HighSemantic Analysis Limiteddist/server-DgmAHyFK.mjs#virtual:normalized:round1

Affected versions and remediation

This report applies to @tekmidian/pai@0.66.1.

See all versions of @tekmidian/pai for other recorded verdicts.

Review the evidence and your use of @tekmidian/pai@0.66.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 18:32:01.186Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.