@tekmidian/pai@0.66.49

⚠ Under review

PAI Knowledge OS — Personal AI Infrastructure with federated memory and project management

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The manifest and inspected daemon call sites do not substantiate the supplied malicious labels, and the inspected Todoist setup is consent-gated. Relevant runtime and agent-integration behavior remains unresolved, so the source evidence is insufficient for a clean or malicious verdict.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

No malicious trigger was verified.

Impact

No concrete attack impact was established.

Mechanism

The inspected daemon excerpts save search results and dispatch IPC requests; other flagged runtime behavior remains unresolved.

AI rationale

Decision evidence

public snapshot

AI called this Manual Review at 42.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest defines a prepublishOnly hook, but no preinstall, install, or postinstall hook.
Daemon account-related matches save memory-search results and dispatch requested tools through its local IPC server.
The inspected setup flow asks before enabling Todoist and prompts before using an environment token.

Evidence against

The available inspection did not resolve all flagged runtime and agent-integration behavior, so it cannot establish that the package is clean.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 191 file(s), 9.45 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.example.com, api.kimi.ai, api.openai.com, api.todoist.com, api.z.ai, app.todoist.com, claude.com, example.invalid, github.com, huggingface.co, json-schema.org, ntfy.sh, www.apple.com, www.postgresql.org, www.w3.org

Source & flagged code

17 flagged

dist/embedding-gate-BwkbwfIL.mjsView file

5Source sends the broad process environment to a literal external destination. L5: import { join } from "node:path"; L6: import { execFileSync } from "node:child_process"; L7: import { createHash } from "node:crypto"; ... L64: const OLLAMA_DEFAULT_MODEL = "arctic-embed-m-v1.5-f16"; L65: const OLLAMA_DEFAULT_URL = "http://127.0.0.1:11434"; L66: const TOKENIZER_MODEL = "Snowflake/snowflake-arctic-embed-m-v1.5"; ... L109: }; L110: names = (await r.json()).models?.map((m) => m.name) ?? []; L111: } catch { ... L128: const f = deps.fetch ?? fetch; L129: const log = deps.log ?? ((m) => process.stderr.write(`${m}\n`)); L130: const getTok = deps.tokenizer ?? loadTokenizer;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/embedding-gate-BwkbwfIL.mjsView on unpkg · L5

5import { join } from "node:path"; L6: import { execFileSync } from "node:child_process"; L7: import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/embedding-gate-BwkbwfIL.mjsView on unpkg · L5

dist/program-DgcwJN6Z.mjsView file

10661const result = spawnSync(command, { L10662: shell: true, L10663: cwd,

High

Shell

Package source references shell execution.

dist/program-DgcwJN6Z.mjsView on unpkg · L10661

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/program-DgcwJN6Z.mjs: import { appendFileSync, chmodSync, closeSync, copyFileSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, readlinkSync... import { createInterface } from "node:readline"; writeFileSync(join(targetPath, "Notes", "MEMORY.md"), memoryContent, "utf-8"); const claudeProjects = join(homedir(), ".claude", "projects"); writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n"); * ~/.claude.json's mcpServers / workers.mcpSets the same way `--mcp` is. const claudeProjects = join(homedir(), ".claude", "projects"); claude_notes_exists: r.claudeNotesExis

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/program-DgcwJN6Z.mjsView on unpkg

29import chalk from "chalk"; L30: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process"; L31: import { parseDocument } from "yaml"; ... L36: import BetterSqlite3 from "better-sqlite3"; L37: import http from "node:http"; L38: import { createInterface } from "node:readline"; ... L235: * Core project CRUD commands: add, list, info, archive, unarchive, move, tag, L236: * alias, edit, detect, consolidate, go, rebind — plus private helpers levenshtein, L237: * containsIgnoreCase, findProjectNotesDirs, and findMovedPath. ... L249: function findProjectNotesDirs(project) { L250: const claudeProjects = join(homedir(), ".claude", "projects"); L251: if (!existsSync(claudeProjects)) return [];

High

dist/daemon-mcp/index.mjsView file

155try { L156: new Function(""); L157: return true;

High

Eval

Package source references dynamic code evaluation.

dist/daemon-mcp/index.mjsView on unpkg · L155

scripts/build-docs.mjsView file

335L336: const mod = await import(pathToFileURL(PROGRAM_MJS).href); L337: if (typeof mod.buildProgram !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/build-docs.mjsView on unpkg · L335

dist/hooks/load-project-context.mjsView file

3const require = __paiCreateRequire(import.meta.url); L4: if (!process.env.PAI_QUIET_NOTICES) process.env.PAI_QUIET_NOTICES = '1'; L5: var __create = Object.create; ... L2609: if (typeof node_buffer.Buffer === "function") { L2610: return node_buffer.Buffer.from(src, "base64"); L2611: } else if (typeof atob === "function") { ... L5223: yield* this.next(token); L5224: yield* this.end(forceDoc, endOffset); L5225: } ... L7424: import { join, dirname } from "node:path"; L7425: function paiHomeDir() { L7426: return process.env.PAI_HOME || join(homedir(), ".claude", "pai");

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/hooks/load-project-context.mjsView on unpkg · L3

dist/hooks/cleanup-session-files.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: replace(/\$home/g, homedir2()); value = value.replace(/^~(?=\/|$)/, homedir2()); if (process.env[key] === void 0) { process.env[key] = value; } } } break; } catch { } } } } loadenvfile(); function defaultadapterdir() { return resolve(homedir2(), ".claude"); } function suppressdeprecationnotices() { if (process.env.pai_quiet_notices === "1") return true; const idx = process.argv.indexof("--output-format"); return idx !== -1 && process.argv[idx + 1] === "json"; } function warnpaidirdeprecatedonce(message) { const g = globalthis; if (g.__paidirnoticeprinted || suppressdeprecationnotices()) return;

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/hooks/cleanup-session-files.mjsView on unpkg

dist/pool-cli-kGGuZCzJ.mjsView file

6Cross-file remote execution chain: dist/pool-cli-kGGuZCzJ.mjs spawns dist/hooks/worker-pool-host.mjs; helper contains network access plus dynamic code execution. L6: import { dirname, join } from "node:path"; L7: import { spawn } from "node:child_process"; L8: import { fileURLToPath } from "node:url"; L9: import { request } from "node:http"; L10: ... L60: req.on("error", () => {}); L61: req.end(); L62: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/pool-cli-kGGuZCzJ.mjsView on unpkg · L6

tab-color-command.shView file

•path = tab-color-command.sh kind = build_helper sizeBytes = 860 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tab-color-command.shView on unpkg

dist/status-B0br9zV0.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/status-B0br9zV0.mjs#virtual:normalized:round1View on unpkg

dist/run-CsrBbtj_.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tekmidian/pai@0.66.48 matchedIdentity = npm:QHRla21pZGlhbi9wYWk:0.66.48 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/run-CsrBbtj_.mjsView on unpkg

Source & flagged code

17 flagged · loading source

dist/embedding-gate-BwkbwfIL.mjsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/embedding-gate-BwkbwfIL.mjsView on unpkg · L5

5import { join } from "node:path"; L6: import { execFileSync } from "node:child_process"; L7: import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/embedding-gate-BwkbwfIL.mjsView on unpkg · L5

dist/program-DgcwJN6Z.mjsView file

Findings

3 Critical10 High6 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationdist/embedding-gate-BwkbwfIL.mjs

CriticalCredential Exfiltrationdist/hooks/load-project-context.mjs

CriticalPrevious Version Dangerous Deltadist/run-CsrBbtj_.mjs

HighChild Processdist/embedding-gate-BwkbwfIL.mjs

HighShelldist/program-DgcwJN6Z.mjs

HighEvaldist/daemon-mcp/index.mjs

HighCredential Redirect Persistencedist/program-DgcwJN6Z.mjs

HighCommand Output Exfiltrationdist/program-DgcwJN6Z.mjs

HighExternal Ai Agent Control Surface Mutationdist/hooks/cleanup-session-files.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/program-DgcwJN6Z.mjs

Affected versions and remediation

This report applies to @tekmidian/pai@0.66.49.

See all versions of @tekmidian/pai for other recorded verdicts.

Review the evidence and your use of @tekmidian/pai@0.66.49 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 06:43:40.602Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code