@tekmidian/pai@0.66.5
PAI Knowledge OS — Personal AI Infrastructure with federated memory and project management
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe package exposes agent configuration and session-file handling capabilities that merit a warning, but inspected source does not establish an unconsented install-time action or a concrete attack. The manifest's only lifecycle script is `prepublishOnly`.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A CLI or agent hook action may activate the configuration and transcript handling code.
Impact
Agent configuration and session files can be changed or copied, but no malicious effect was confirmed from the inspected evidence.
Mechanism
The CLI merges command hooks into a settings object; the cleanup hook links or copies transcript files into a sessions directory.
AI rationale
The package exposes agent configuration and session-file handling capabilities that merit a warning, but inspected source does not establish an unconsented install-time action or a concrete attack. The manifest's only lifecycle script is `prepublishOnly`.
Evidence
dist/program-DB-hoyfW.mjsdist/hooks/cleanup-session-files.mjs~/.claude/settings.jsonClaude project session files
Decision evidence
public snapshotAI called this Suspicious at 67.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json defines a `prepublishOnly` script; it shows no npm install hook.
- Agent integration code references Claude configuration and project paths, and hook files resolve a PAI home directory.
- The CLI contains hook-merging logic that adds command hooks to a settings object.
- The cleanup hook archives session transcript files into a `sessions` directory.
- The context hook sends a notification to ntfy.sh only when `NTFY_TOPIC` is set.
- The test describes a command hook that may pass commands through without rewriting them.
Evidence against
- The inspected manifest does not establish an install-time trigger for agent configuration changes.
- The inspected source does not establish credential forwarding to an unrelated recipient or an active attack chain.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
13 flagged · loading sourcedist/main-resolver-SfGGg1DB.mjsView file
8import chalk from "chalk";
L9: import { spawnSync } from "node:child_process";
L10: import { createInterface } from "node:readline";
High
Child Process
Package source references child process execution.
dist/main-resolver-SfGGg1DB.mjsView on unpkg · L8dist/program-DB-hoyfW.mjsView file
10524const result = spawnSync(command, {
L10525: shell: true,
L10526: cwd,
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/program-DB-hoyfW.mjs:
import { appendFileSync, chmodSync, closeSync, copyFileSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, readlinkSync, realpath...
import { createInterface } from "node:readline";
* 08 - Others/MDF/Infrastruktur/.claude/worktrees/cool-haibt 1 session
* 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions
fragment: `${sep}.claude${sep}worktrees${sep}`,
writeFileSync(join(targetPath, "Notes", "MEMORY.md"), memoryContent, "utf-8");
const claudeProjects = join(homedir(), ".claude", "projects");
writeFileSync(configPath, JSON.strin
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/program-DB-hoyfW.mjsView on unpkg•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
l.template.md");
if (!existssync(templatepath)) {
console.log(c.warn("skill template not found: " + templatepath));
console.log(c.dim(" skipping pai skill installation."));
return false;
}
const skilldir = join(homedir(), ".claude", "skills", "pai");
const skillfile = join(skilldir, "skill.md");
if (existssync(skillfile)) {
const content = readfilesync(skillfile, "utf-8");
const isgenerated = content.includes("generated by pai setup");
if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md."));
else {
console.log(c.yellow(" found existing skill.md (not pai-generated)."));
console.log(c.dim(" a backup will be created before overwri
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/program-DB-hoyfW.mjsView on unpkgdist/daemon-mcp/index.mjsView file
150try {
L151: new Function("");
L152: return true;
High
scripts/build-docs.mjsView file
335L336: const mod = await import(pathToFileURL(PROGRAM_MJS).href);
L337: if (typeof mod.buildProgram !== "function") {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/build-docs.mjsView on unpkg · L335dist/context-handover-cache-BbCYQUGo.mjsView file
14Cross-file remote execution chain: dist/context-handover-cache-BbCYQUGo.mjs spawns dist/daemon-mcp/index.mjs; helper contains network access plus dynamic code execution.
L14: import { randomUUID } from "node:crypto";
L15: import { spawn, spawnSync } from "node:child_process";
L16: import { copyFileSync as copyFileSync$1, existsSync as existsSync$1, linkSync as linkSync$1, mkdirSync as mkdirSync$1, readFileSync as readFileSync$1, readdirSync as readdirSync$1,...
...
L35: *
L36: * @param cwd Absolute path to detect (defaults to process.cwd())
L37: * @returns The best matching project, or null if no match
...
L167: try {
L168: head = readFileSync(file).subarray(0, maxBytes).toString("utf-8");
L169: } catch {
...
L633: console.error(err(String(e)));
L634: process.exitCode = 1;
L635: return
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/context-handover-cache-BbCYQUGo.mjsView on unpkg · L1414Trigger-reachable persistence chain: manifest.bin -> dist/cli/index.mjs -> dist/context-handover-cache-BbCYQUGo.mjs
L14: import { randomUUID } from "node:crypto";
L15: import { spawn, spawnSync } from "node:child_process";
L16: import { copyFileSync as copyFileSync$1, existsSync as existsSync$1, linkSync as linkSync$1, mkdirSync as mkdirSync$1, readFileSync as readFileSync$1, readdirSync as readdirSync$1,...
...
L35: *
L36: * @param cwd Absolute path to detect (defaults to process.cwd())
L37: * @returns The best matching project, or null if no match
...
L167: try {
L168: head = readFileSync(file).subarray(0, maxBytes).toString("utf-8");
L169: } catch {
...
L633: console.error(err(String(e)));
L634: process.exitCode = 1;
L635: return;
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/context-handover-cache-BbCYQUGo.mjsView on unpkg · L1414import { randomUUID } from "node:crypto";
L15: import { spawn, spawnSync } from "node:child_process";
L16: import { copyFileSync as copyFileSync$1, existsSync as existsSync$1, linkSync as linkSync$1, mkdirSync as mkdirSync$1, readFileSync as readFileSync$1, readdirSync as readdirSync$1,...
...
L35: *
L36: * @param cwd Absolute path to detect (defaults to process.cwd())
L37: * @returns The best matching project, or null if no match
...
L167: try {
L168: head = readFileSync(file).subarray(0, maxBytes).toString("utf-8");
L169: } catch {
...
L633: console.error(err(String(e)));
L634: process.exitCode = 1;
L635: return;
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/context-handover-cache-BbCYQUGo.mjsView on unpkg · L14dist/hooks/load-project-context.mjsView file
3const require = __paiCreateRequire(import.meta.url);
L4: if (!process.env.PAI_QUIET_NOTICES) process.env.PAI_QUIET_NOTICES = '1';
L5: var __create = Object.create;
...
L2609: if (typeof node_buffer.Buffer === "function") {
L2610: return node_buffer.Buffer.from(src, "base64");
L2611: } else if (typeof atob === "function") {
...
L5223: yield* this.next(token);
L5224: yield* this.end(forceDoc, endOffset);
L5225: }
...
L7424: import { join, dirname } from "node:path";
L7425: function paiHomeDir() {
L7426: return process.env.PAI_HOME || join(homedir(), ".claude", "pai");
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/hooks/load-project-context.mjsView on unpkg · L3dist/hooks/cleanup-session-files.mjsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
import { existssync as existssync2, mkdirsync, readdirsync, linksync, copyfilesync } from "fs";
import { join as join2, basename } from "path";
import { homedir } from "os";
import { resolve, join } from "path";
import { existssync, readfilesync } from "fs";
function loadenvfile() {
const possiblepaths = [
resolve(process.env.adapter_dir || process.env.pai_dir || "", ".env"),
resolve(homedir(), ".claude", ".env")
];
for (const envpath of possiblepaths) {
if (existssync(envpath)) {
try {
const content = readfilesync(envpath, "utf-8");
for (const line of content.split("\n")) {
const trimmed = line.trim();
if (
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/hooks/cleanup-session-files.mjsView on unpkgtab-color-command.shView file
•path = tab-color-command.sh
kind = build_helper
sizeBytes = 860
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
tab-color-command.shView on unpkgsrc/hooks/ztk-auto.test.ts#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/hooks/ztk-auto.test.ts#virtual:normalized:round1View on unpkgFindings
1 Critical9 High6 Medium5 Low
CriticalCredential Exfiltrationdist/hooks/load-project-context.mjs
HighChild Processdist/main-resolver-SfGGg1DB.mjs
HighShelldist/program-DB-hoyfW.mjs
HighEvaldist/daemon-mcp/index.mjs
HighCredential Redirect Persistencedist/program-DB-hoyfW.mjs
HighExternal Ai Agent Control Surface Mutationdist/hooks/cleanup-session-files.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/program-DB-hoyfW.mjs
HighCross File Remote Execution Contextdist/context-handover-cache-BbCYQUGo.mjs
HighTrigger Reachable Persistencedist/context-handover-cache-BbCYQUGo.mjs
HighSemantic Analysis Limitedsrc/hooks/ztk-auto.test.ts#virtual:normalized:round1
MediumDynamic Requirescripts/build-docs.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/context-handover-cache-BbCYQUGo.mjs
MediumShips Build Helpertab-color-command.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tekmidian/pai@0.66.5.
See all versions of @tekmidian/pai for other recorded verdicts.
- Review the evidence and your use of @tekmidian/pai@0.66.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.