registry / @tekmidian/pai / 0.67.1
@tekmidian/pai@0.67.1
⚠ Under reviewPAI Knowledge OS — Personal AI Infrastructure with federated memory and project management
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe inspected source does not substantiate the scanner’s malicious labels, and the visible behaviors appear consistent with package setup and model provisioning. The flagged runtime paths remain unresolved, so the evidence is insufficient for a clean verdict or a concrete warning or block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Unresolved; the inspected snippets do not establish an activating path for the flagged behavior.
Impact
No concrete impact was confirmed; further source review is needed to resolve the remaining indicators.
Mechanism
The excerpts show ordinary setup and model provisioning behavior, but do not resolve the flagged credential transfer or agent configuration paths.
AI rationale
The inspected source does not substantiate the scanner’s malicious labels, and the visible behaviors appear consistent with package setup and model provisioning. The flagged runtime paths remain unresolved, so the evidence is insufficient for a clean verdict or a concrete warning or block.
Decision evidence
public snapshotAI called this Manual Review at 49.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json shows a prepublishOnly build and worker-check command; no preinstall, install, or postinstall hook was present in the inspected scripts.
- The embedding helper verifies a downloaded model’s size and checksum before importing it through the configured Ollama binary.
- The inspected CLI snippets show registry scanning and optional copying of a PAI example preferences file during setup.
- The provider URLs inspected appear in sample configuration with placeholder credentials.
Evidence against
- The scanner flags credential redirection, data exfiltration, and agent configuration mutation, but the inspected excerpts do not establish those behaviors or their activation paths.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
15 flagged · loading sourcedist/embedding-gate-Cc5UQcO7.mjsView file
5Source sends the broad process environment to a literal external destination.
L5: import { join } from "node:path";
L6: import { execFileSync } from "node:child_process";
L7: import { createHash } from "node:crypto";
...
L64: const OLLAMA_DEFAULT_MODEL = "arctic-embed-m-v1.5-f16";
L65: const OLLAMA_DEFAULT_URL = "http://127.0.0.1:11434";
L66: const TOKENIZER_MODEL = "Snowflake/snowflake-arctic-embed-m-v1.5";
...
L109: };
L110: names = (await r.json()).models?.map((m) => m.name) ?? [];
L111: } catch {
...
L128: const f = deps.fetch ?? fetch;
L129: const log = deps.log ?? ((m) => process.stderr.write(`${m}\n`));
L130: const getTok = deps.tokenizer ?? loadTokenizer;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/embedding-gate-Cc5UQcO7.mjsView on unpkg · L55import { join } from "node:path";
L6: import { execFileSync } from "node:child_process";
L7: import { createHash } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/embedding-gate-Cc5UQcO7.mjsView on unpkg · L5dist/cli/index.mjsView file
5928try {
L5929: return (await fetch(`http://127.0.0.1:${port}/v1/models`, { signal: AbortSignal.timeout(3e3) })).ok;
L5930: } catch {
...
L5939: const [cmd, ...args] = plan.argv;
L5940: const child = spawn(cmd, args, {
L5941: env: {
L5942: ...process.env,
L5943: ...plan.env
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli/index.mjsView on unpkg · L5928•Trigger-reachable chain: manifest.bin -> dist/cli/index.mjs
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cli/index.mjsView on unpkg4161summary: "Wait for a background job to finish",
L4162: description: "Waits at most --max seconds (default 110, limit 590; over ~110 s needs the Bash tool timeout raised, which the PAI hook does automatically) for a process id. Exit 0: ...
L4163: args: [{
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli/index.mjs:
import { appendFileSync, chmodSync, closeSync, copyFileSync, cpSync, createReadStream, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, r...
import { createInterface, emitKeypressEvents } from "node:readline";
writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n");
* Session names live in Claude's clc registry (~/.claude/session.json):
const clcRegistryPath = (home = homedir()) => join(home, ".claude", "session.json");
writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n");
const sessionsDir = join(homedir(), ".claude", "projects", encodedDir, "sessions");
/** Notes dir
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli/index.mjsView on unpkg•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
dir(), "pai-sk[redacted]");
if (!existssync(templatepath)) {
console.log(c.warn("skill template not found: " + templatepath));
console.log(c.dim(" skipping pai skill installation."));
return false;
}
const skilldir = join(homedir(), ".claude", "skills", "pai");
const skillfile = join(skilldir, "skill.md");
if (existssync(skillfile)) {
const content = readfilesync(skillfile, "utf-8");
const isgenerated = content.includes("generated by pai setup");
if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md."));
else {
console.log(c.yellow(" found existing skill.md (not pai-generated)."));
console.log(c.dim(" a backup will be created bef
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/cli/index.mjsView on unpkg33Cross-file remote execution chain: dist/cli/index.mjs spawns dist/daemon-mcp/index.mjs; helper contains network access plus dynamic code execution.
L33: import chalk, { Chalk } from "chalk";
L34: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L35: import { parse, parseDocument } from "yaml";
L36: import { createHash, randomUUID } from "node:crypto";
L37: import http from "node:http";
L38: import { fileURLToPath } from "node:url";
...
L49: *
L50: * Node's stdout/stderr are ASYNCHRONOUS when they point at a pipe (and
L51: * synchronous when they point at a TTY or a regular file). `process.exit()`
...
L73: stream.once("close", () => resolve());
L74: stream.write("", () => resolve());
L75: });
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/cli/index.mjsView on unpkg · L3333Trigger-reachable persistence chain: manifest.bin -> dist/cli/index.mjs
L33: import chalk, { Chalk } from "chalk";
L34: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L35: import { parse, parseDocument } from "yaml";
L36: import { createHash, randomUUID } from "node:crypto";
L37: import http from "node:http";
L38: import { fileURLToPath } from "node:url";
...
L49: *
L50: * Node's stdout/stderr are ASYNCHRONOUS when they point at a pipe (and
L51: * synchronous when they point at a TTY or a regular file). `process.exit()`
...
L73: stream.once("close", () => resolve());
L74: stream.write("", () => resolve());
L75: });
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/cli/index.mjsView on unpkg · L3333import chalk, { Chalk } from "chalk";
L34: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L35: import { parse, parseDocument } from "yaml";
L36: import { createHash, randomUUID } from "node:crypto";
L37: import http from "node:http";
L38: import { fileURLToPath } from "node:url";
...
L49: *
L50: * Node's stdout/stderr are ASYNCHRONOUS when they point at a pipe (and
L51: * synchronous when they point at a TTY or a regular file). `process.exit()`
...
L73: stream.once("close", () => resolve());
L74: stream.write("", () => resolve());
L75: });
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/cli/index.mjsView on unpkg · L3333import chalk, { Chalk } from "chalk";
L34: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L35: import { parse, parseDocument } from "yaml";
L36: import { createHash, randomUUID } from "node:crypto";
L37: import http from "node:http";
L38: import { fileURLToPath } from "node:url";
...
L49: *
L50: * Node's stdout/stderr are ASYNCHRONOUS when they point at a pipe (and
L51: * synchronous when they point at a TTY or a regular file). `process.exit()`
...
L73: stream.once("close", () => resolve());
L74: stream.write("", () => resolve());
L75: });
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/cli/index.mjsView on unpkg · L33dist/hooks/cleanup-session-files.mjsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
replace(/\$home/g, homedir2());
value = value.replace(/^~(?=\/|$)/, homedir2());
if (process.env[key] === void 0) {
process.env[key] = value;
}
}
}
break;
} catch {
}
}
}
}
loadenvfile();
function defaultadapterdir() {
return resolve(homedir2(), ".claude");
}
function suppressdeprecationnotices() {
if (process.env.pai_quiet_notices === "1") return true;
const idx = process.argv.indexof("--output-format");
return idx !== -1 && process.argv[idx + 1] === "json";
}
function warnpaidirdeprecatedonce(message) {
const g = globalthis;
if (g.__paidirnoticeprinted || suppressdeprecationnotices()) return;
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/hooks/cleanup-session-files.mjsView on unpkgtab-color-command.shView file
•path = tab-color-command.sh
kind = build_helper
sizeBytes = 860
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
tab-color-command.shView on unpkgdist/tool-errors-CC8AD53a.mjs#virtual:string-array:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/tool-errors-CC8AD53a.mjs#virtual:string-array:round1View on unpkgdist/hooks/worker-pool-host.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @tekmidian/pai@0.66.48
matchedIdentity = npm:QHRla21pZGlhbi9wYWk:0.66.48
similarity = 0.508
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/hooks/worker-pool-host.mjsView on unpkgFindings
4 Critical8 High5 Medium7 Low
CriticalSame File Env Network Executiondist/cli/index.mjs
CriticalHardcoded Runtime Data Exfiltrationdist/embedding-gate-Cc5UQcO7.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/cli/index.mjs
CriticalPrevious Version Dangerous Deltadist/hooks/worker-pool-host.mjs
HighChild Processdist/embedding-gate-Cc5UQcO7.mjs
HighShelldist/cli/index.mjs
HighCredential Redirect Persistencedist/cli/index.mjs
HighExternal Ai Agent Control Surface Mutationdist/hooks/cleanup-session-files.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/index.mjs
HighCross File Remote Execution Contextdist/cli/index.mjs
HighTrigger Reachable Persistencedist/cli/index.mjs
HighSemantic Analysis Limiteddist/tool-errors-CC8AD53a.mjs#virtual:string-array:round1
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli/index.mjs
MediumShips Build Helpertab-color-command.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowWeak Cryptodist/cli/index.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tekmidian/pai@0.67.1.
See all versions of @tekmidian/pai for other recorded verdicts.
- Review the evidence and your use of @tekmidian/pai@0.67.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.