registry / @tekmidian/pai / 0.66.48
@tekmidian/pai@0.66.48
PAI Knowledge OS — Personal AI Infrastructure with federated memory and project management
AI Security Review
scanned 6d ago · by lpm-firewall-aiSource inspection did not confirm the scanner’s claims of credential redirection or exfiltration: the OAuth token is used with Anthropic’s own usage endpoint, and ntfy notifications require NTFY_TOPIC. The manifest has no install-time lifecycle hook, so the package is clean based on the inspected evidence.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
No malicious trigger was identified; product operations run through the CLI, daemon, and configured hooks.
Impact
No confirmed unauthorized credential disclosure, account action, or harmful mutation was established.
Mechanism
The inspected network calls support product functions, including Anthropic usage polling, optional ntfy notifications, and a model download checked for expected size and hash.
AI rationale
Source inspection did not confirm the scanner’s claims of credential redirection or exfiltration: the OAuth token is used with Anthropic’s own usage endpoint, and ntfy notifications require NTFY_TOPIC. The manifest has no install-time lifecycle hook, so the package is clean based on the inspected evidence.
Network endpoints2
api.anthropic.com/api/oauth/usagentfy.sh/${topic}
Decision evidence
public snapshotAI called this Clean at 83.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines no install-time hook; its lifecycle script is prepublishOnly.
- The flagged OAuth token flow reads a Claude credential and sends it to api.anthropic.com for Anthropic usage data.
- The notification flow requires NTFY_TOPIC before posting to ntfy.sh; the inspected excerpts establish no unrelated credential recipient or confirmed attack.
Evidence against
- The inspected entrypoints and flagged runtime locations show product functions such as worker management, local memory operations, and model download with a size check.
- The inspected source does not substantiate the scanner’s credential-redirection or exfiltration claims.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
17 flagged · loading sourcedist/fallback-DyhAZAOe.mjsView file
9import { basename, dirname, join, relative, resolve } from "node:path";
L10: import { execFileSync, spawn } from "node:child_process";
L11: import { Document, parse } from "yaml";
High
Child Process
Package source references child process execution.
dist/fallback-DyhAZAOe.mjsView on unpkg · L9dist/program-B7gVKc-u.mjsView file
10663const result = spawnSync(command, {
L10664: shell: true,
L10665: cwd,
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/program-B7gVKc-u.mjs:
import { appendFileSync, chmodSync, closeSync, copyFileSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, readlinkSync...
import { createInterface } from "node:readline";
writeFileSync(join(targetPath, "Notes", "MEMORY.md"), memoryContent, "utf-8");
const claudeProjects = join(homedir(), ".claude", "projects");
writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
* ~/.claude.json's mcpServers / workers.mcpSets the same way `--mcp` is.
const claudeProjects = join(homedir(), ".claude", "projects");
claude_notes_exists: r.claudeNotesExis
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/program-B7gVKc-u.mjsView on unpkg29import chalk from "chalk";
L30: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L31: import { parseDocument } from "yaml";
...
L35: import pg from "pg";
L36: import net from "node:net";
L37: import BetterSqlite3 from "better-sqlite3";
...
L237: * Core project CRUD commands: add, list, info, archive, unarchive, move, tag,
L238: * alias, edit, detect, consolidate, go, rebind — plus private helpers levenshtein,
L239: * containsIgnoreCase, findProjectNotesDirs, and findMovedPath.
...
L251: function findProjectNotesDirs(project) {
L252: const claudeProjects = join(homedir(), ".claude", "projects");
L253: if (!existsSync(claudeProjects)) return [];
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/program-B7gVKc-u.mjsView on unpkg · L29•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
l.template.md");
if (!existssync(templatepath)) {
console.log(c.warn("skill template not found: " + templatepath));
console.log(c.dim(" skipping pai skill installation."));
return false;
}
const skilldir = join(homedir(), ".claude", "skills", "pai");
const skillfile = join(skilldir, "skill.md");
if (existssync(skillfile)) {
const content = readfilesync(skillfile, "utf-8");
const isgenerated = content.includes("generated by pai setup");
if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md."));
else {
console.log(c.yellow(" found existing skill.md (not pai-generated)."));
console.log(c.dim(" a backup will be created before overwri
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/program-B7gVKc-u.mjsView on unpkg29Trigger-reachable persistence chain: manifest.bin -> dist/cli/index.mjs -> dist/program-B7gVKc-u.mjs
L29: import chalk from "chalk";
L30: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L31: import { parseDocument } from "yaml";
...
L35: import pg from "pg";
L36: import net from "node:net";
L37: import BetterSqlite3 from "better-sqlite3";
...
L237: * Core project CRUD commands: add, list, info, archive, unarchive, move, tag,
L238: * alias, edit, detect, consolidate, go, rebind — plus private helpers levenshtein,
L239: * containsIgnoreCase, findProjectNotesDirs, and findMovedPath.
...
L251: function findProjectNotesDirs(project) {
L252: const claudeProjects = join(homedir(), ".claude", "projects");
L253: if (!existsSync(claudeProjects)) return [];
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/program-B7gVKc-u.mjsView on unpkg · L2929import chalk from "chalk";
L30: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L31: import { parseDocument } from "yaml";
...
L35: import pg from "pg";
L36: import net from "node:net";
L37: import BetterSqlite3 from "better-sqlite3";
...
L237: * Core project CRUD commands: add, list, info, archive, unarchive, move, tag,
L238: * alias, edit, detect, consolidate, go, rebind — plus private helpers levenshtein,
L239: * containsIgnoreCase, findProjectNotesDirs, and findMovedPath.
...
L251: function findProjectNotesDirs(project) {
L252: const claudeProjects = join(homedir(), ".claude", "projects");
L253: if (!existsSync(claudeProjects)) return [];
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/program-B7gVKc-u.mjsView on unpkg · L2929import chalk from "chalk";
L30: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L31: import { parseDocument } from "yaml";
...
L35: import pg from "pg";
L36: import net from "node:net";
L37: import BetterSqlite3 from "better-sqlite3";
...
L237: * Core project CRUD commands: add, list, info, archive, unarchive, move, tag,
L238: * alias, edit, detect, consolidate, go, rebind — plus private helpers levenshtein,
L239: * containsIgnoreCase, findProjectNotesDirs, and findMovedPath.
...
L251: function findProjectNotesDirs(project) {
L252: const claudeProjects = join(homedir(), ".claude", "projects");
L253: if (!existsSync(claudeProjects)) return [];
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/program-B7gVKc-u.mjsView on unpkg · L29dist/daemon-mcp/index.mjsView file
155try {
L156: new Function("");
L157: return true;
High
scripts/build-docs.mjsView file
335L336: const mod = await import(pathToFileURL(PROGRAM_MJS).href);
L337: if (typeof mod.buildProgram !== "function") {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/build-docs.mjsView on unpkg · L335dist/embedding-gate-BwkbwfIL.mjsView file
5Source sends the broad process environment to a literal external destination.
L5: import { join } from "node:path";
L6: import { execFileSync } from "node:child_process";
L7: import { createHash } from "node:crypto";
...
L64: const OLLAMA_DEFAULT_MODEL = "arctic-embed-m-v1.5-f16";
L65: const OLLAMA_DEFAULT_URL = "http://127.0.0.1:11434";
L66: const TOKENIZER_MODEL = "Snowflake/snowflake-arctic-embed-m-v1.5";
...
L109: };
L110: names = (await r.json()).models?.map((m) => m.name) ?? [];
L111: } catch {
...
L128: const f = deps.fetch ?? fetch;
L129: const log = deps.log ?? ((m) => process.stderr.write(`${m}\n`));
L130: const getTok = deps.tokenizer ?? loadTokenizer;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/embedding-gate-BwkbwfIL.mjsView on unpkg · L5dist/hooks/load-project-context.mjsView file
3const require = __paiCreateRequire(import.meta.url);
L4: if (!process.env.PAI_QUIET_NOTICES) process.env.PAI_QUIET_NOTICES = '1';
L5: var __create = Object.create;
...
L2609: if (typeof node_buffer.Buffer === "function") {
L2610: return node_buffer.Buffer.from(src, "base64");
L2611: } else if (typeof atob === "function") {
...
L5223: yield* this.next(token);
L5224: yield* this.end(forceDoc, endOffset);
L5225: }
...
L7424: import { join, dirname } from "node:path";
L7425: function paiHomeDir() {
L7426: return process.env.PAI_HOME || join(homedir(), ".claude", "pai");
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/hooks/load-project-context.mjsView on unpkg · L3dist/hooks/cleanup-session-files.mjsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
replace(/\$home/g, homedir2());
value = value.replace(/^~(?=\/|$)/, homedir2());
if (process.env[key] === void 0) {
process.env[key] = value;
}
}
}
break;
} catch {
}
}
}
}
loadenvfile();
function defaultadapterdir() {
return resolve(homedir2(), ".claude");
}
function suppressdeprecationnotices() {
if (process.env.pai_quiet_notices === "1") return true;
const idx = process.argv.indexof("--output-format");
return idx !== -1 && process.argv[idx + 1] === "json";
}
function warnpaidirdeprecatedonce(message) {
const g = globalthis;
if (g.__paidirnoticeprinted || suppressdeprecationnotices()) return;
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/hooks/cleanup-session-files.mjsView on unpkgdist/pool-cli-DerrWWpP.mjsView file
6Cross-file remote execution chain: dist/pool-cli-DerrWWpP.mjs spawns dist/hooks/worker-pool-host.mjs; helper contains network access plus dynamic code execution.
L6: import { dirname, join } from "node:path";
L7: import { spawn } from "node:child_process";
L8: import { fileURLToPath } from "node:url";
L9: import { request } from "node:http";
L10:
...
L60: req.on("error", () => {});
L61: req.end();
L62: }
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/pool-cli-DerrWWpP.mjsView on unpkg · L6tab-color-command.shView file
•path = tab-color-command.sh
kind = build_helper
sizeBytes = 860
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
tab-color-command.shView on unpkgdist/status-C3fBJKU_.mjs#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/status-C3fBJKU_.mjs#virtual:normalized:round1View on unpkgdist/hooks/worker-pool-host.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @tekmidian/pai@0.66.5
matchedIdentity = npm:QHRla21pZGlhbi9wYWk:0.66.5
similarity = 0.533
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/hooks/worker-pool-host.mjsView on unpkgFindings
3 Critical10 High6 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/embedding-gate-BwkbwfIL.mjs
CriticalCredential Exfiltrationdist/hooks/load-project-context.mjs
CriticalPrevious Version Dangerous Deltadist/hooks/worker-pool-host.mjs
HighChild Processdist/fallback-DyhAZAOe.mjs
HighShelldist/program-B7gVKc-u.mjs
HighEvaldist/daemon-mcp/index.mjs
HighCredential Redirect Persistencedist/program-B7gVKc-u.mjs
HighCommand Output Exfiltrationdist/program-B7gVKc-u.mjs
HighExternal Ai Agent Control Surface Mutationdist/hooks/cleanup-session-files.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/program-B7gVKc-u.mjs
HighCross File Remote Execution Contextdist/pool-cli-DerrWWpP.mjs
HighTrigger Reachable Persistencedist/program-B7gVKc-u.mjs
HighSemantic Analysis Limiteddist/status-C3fBJKU_.mjs#virtual:normalized:round1
MediumDynamic Requirescripts/build-docs.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/program-B7gVKc-u.mjs
MediumShips Build Helpertab-color-command.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/program-B7gVKc-u.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tekmidian/pai@0.66.48.
See all versions of @tekmidian/pai for other recorded verdicts.
- Review the evidence and your use of @tekmidian/pai@0.66.48 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.