@tekmidian/pai@0.68.0

PAI Knowledge OS — Personal AI Infrastructure with federated memory and project management

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The manifest has no consumer install hook, and the inspected runtime excerpts support ordinary CLI, configuration, memory, and model-setup behavior. The scanner hints did not establish credential theft or another concrete attack in source.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user runs a CLI rename, daemon request, or embedding setup operation.

Impact

No unauthorized credential transfer, unsolicited account change, or other concrete attack was established.

Mechanism

The inspected code changes local session/configuration data, processes requested memory operations, or downloads and verifies an embedding model.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json has no install lifecycle hook; its prepublishOnly script runs a build and a worker check during publishing.
The inspected Claude session helper renames a session in ~/.claude/session.json, and the CLI caller invokes it for a rename action.
The daemon excerpts show request-dispatched memory search and retrieval behavior; the account-action location records the caller's memory search query.
The inspected configuration, provider, and runtime excerpts show local path resolution, text processing, provider selection, and request handling.
The embedding setup fetches a model and checks its size and SHA-256 before importing it; worker setup removes ANTHROPIC_API_KEY from the inherited environment.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

15 flagged

dist/indexer-backend-CE29cwq4.mjsView file

16import { basename, delimiter, dirname, join, resolve } from "node:path"; L17: import { spawn, spawnSync } from "node:child_process"; L18: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/indexer-backend-CE29cwq4.mjsView on unpkg · L16

16import { basename, delimiter, dirname, join, resolve } from "node:path"; L17: import { spawn, spawnSync } from "node:child_process"; L18: import { randomUUID } from "node:crypto"; ... L544: ...opts, L545: body: effectiveBody L546: }); ... L582: function getPaiDir() { L583: const envDir = process.env.ADAPTER_DIR || process.env.PAI_DIR; L584: if (envDir) try { ... L588: } L589: return join(homedir(), ".claude"); L590: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/indexer-backend-CE29cwq4.mjsView on unpkg · L16

dist/cli/index.mjsView file

5932try { L5933: return (await fetch(`http://127.0.0.1:${port}/v1/models`, { signal: AbortSignal.timeout(3e3) })).ok; L5934: } catch { ... L5943: const [cmd, ...args] = plan.argv; L5944: const child = spawn(cmd, args, { L5945: env: { L5946: ...process.env, L5947: ...plan.env

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli/index.mjsView on unpkg · L5932

•Trigger-reachable chain: manifest.bin -> dist/cli/index.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/index.mjsView on unpkg

4318summary: "Wait for a background job to finish", L4319: description: "Waits at most --max seconds (default 110, limit 590; over ~110 s needs the Bash tool timeout raised, which the PAI hook does automatically) for a process id. Exit 0: ... L4320: args: [{

High

Shell

Package source references shell execution.

dist/cli/index.mjsView on unpkg · L4318

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli/index.mjs: import { appendFileSync, chmodSync, closeSync, copyFileSync, cpSync, createReadStream, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, r... import { createInterface, emitKeypressEvents } from "node:readline"; writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n"); * Session names live in Claude's clc registry (~/.claude/session.json): const clcRegistryPath = (home = homedir()) => join(home, ".claude", "session.json"); writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n"); const sessionsDir = join(homedir(), ".claude", "projects", encodedDir, "sessions"); /** Notes dir

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli/index.mjsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. dir(), "pai-sk[redacted]"); if (!existssync(templatepath)) { console.log(c.warn("skill template not found: " + templatepath)); console.log(c.dim(" skipping pai skill installation.")); return false; } const skilldir = join(homedir(), ".claude", "skills", "pai"); const skillfile = join(skilldir, "skill.md"); if (existssync(skillfile)) { const content = readfilesync(skillfile, "utf-8"); const isgenerated = content.includes("generated by pai setup"); if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md.")); else { console.log(c.yellow(" found existing skill.md (not pai-generated).")); console.log(c.dim(" a backup will be created bef

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/index.mjsView on unpkg

36Cross-file remote execution chain: dist/cli/index.mjs spawns dist/daemon-mcp/index.mjs; helper contains network access plus dynamic code execution. L36: import chalk, { Chalk } from "chalk"; L37: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process"; L38: import { parseDocument } from "yaml"; L39: import { createHash, randomUUID } from "node:crypto"; L40: import http from "node:http"; L41: import { fileURLToPath } from "node:url"; ... L52: * L53: * Node's stdout/stderr are ASYNCHRONOUS when they point at a pipe (and L54: * synchronous when they point at a TTY or a regular file). `process.exit()` ... L76: stream.once("close", () => resolve()); L77: stream.write("", () => resolve()); L78: });

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.mjsView on unpkg · L36

36Trigger-reachable persistence chain: manifest.bin -> dist/cli/index.mjs L36: import chalk, { Chalk } from "chalk"; L37: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process"; L38: import { parseDocument } from "yaml"; L39: import { createHash, randomUUID } from "node:crypto"; L40: import http from "node:http"; L41: import { fileURLToPath } from "node:url"; ... L52: * L53: * Node's stdout/stderr are ASYNCHRONOUS when they point at a pipe (and L54: * synchronous when they point at a TTY or a regular file). `process.exit()` ... L76: stream.once("close", () => resolve()); L77: stream.write("", () => resolve()); L78: });

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli/index.mjsView on unpkg · L36

36import chalk, { Chalk } from "chalk"; L37: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process"; L38: import { parseDocument } from "yaml"; L39: import { createHash, randomUUID } from "node:crypto"; L40: import http from "node:http"; L41: import { fileURLToPath } from "node:url"; ... L52: * L53: * Node's stdout/stderr are ASYNCHRONOUS when they point at a pipe (and L54: * synchronous when they point at a TTY or a regular file). `process.exit()` ... L76: stream.once("close", () => resolve()); L77: stream.write("", () => resolve()); L78: });

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/index.mjsView on unpkg · L36

dist/embedding-gate-CbgpBrjA.mjsView file

5Source sends the broad process environment to a literal external destination. L5: import { join } from "node:path"; L6: import { execFileSync } from "node:child_process"; L7: import { createHash } from "node:crypto"; ... L64: const OLLAMA_DEFAULT_MODEL = "arctic-embed-m-v1.5-f16"; L65: const OLLAMA_DEFAULT_URL = "http://127.0.0.1:11434"; L66: const TOKENIZER_MODEL = "Snowflake/snowflake-arctic-embed-m-v1.5"; ... L109: }; L110: names = (await r.json()).models?.map((m) => m.name) ?? []; L111: } catch { ... L128: const f = deps.fetch ?? fetch; L129: const log = deps.log ?? ((m) => process.stderr.write(`${m}\n`)); L130: const getTok = deps.tokenizer ?? loadTokenizer;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/embedding-gate-CbgpBrjA.mjsView on unpkg · L5

dist/hooks/cleanup-session-files.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: replace(/\$home/g, homedir2()); value = value.replace(/^~(?=\/|$)/, homedir2()); if (process.env[key] === void 0) { process.env[key] = value; } } } break; } catch { } } } } loadenvfile(); function defaultadapterdir() { return resolve(homedir2(), ".claude"); } function suppressdeprecationnotices() { if (process.env.pai_quiet_notices === "1") return true; const idx = process.argv.indexof("--output-format"); return idx !== -1 && process.argv[idx + 1] === "json"; } function warnpaidirdeprecatedonce(message) { const g = globalthis; if (g.__paidirnoticeprinted || suppressdeprecationnotices()) return;

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/hooks/cleanup-session-files.mjsView on unpkg

tab-color-command.shView file

•path = tab-color-command.sh kind = build_helper sizeBytes = 860 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tab-color-command.shView on unpkg

dist/worktree-Dh_ev4bO.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/worktree-Dh_ev4bO.mjs#virtual:normalized:round1View on unpkg

dist/hooks/worker-pool-host.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tekmidian/pai@0.66.48 matchedIdentity = npm:QHRla21pZGlhbi9wYWk:0.66.48 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/hooks/worker-pool-host.mjsView on unpkg

Source & flagged code

15 flagged · loading source

dist/indexer-backend-CE29cwq4.mjsView file

16import { basename, delimiter, dirname, join, resolve } from "node:path"; L17: import { spawn, spawnSync } from "node:child_process"; L18: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/indexer-backend-CE29cwq4.mjsView on unpkg · L16

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/indexer-backend-CE29cwq4.mjsView on unpkg · L16

dist/cli/index.mjsView file

5932

Findings

4 Critical8 High5 Medium7 Low

CriticalSame File Env Network Executiondist/cli/index.mjs

CriticalHardcoded Runtime Data Exfiltrationdist/embedding-gate-CbgpBrjA.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/cli/index.mjs

CriticalPrevious Version Dangerous Deltadist/hooks/worker-pool-host.mjs

HighChild Processdist/indexer-backend-CE29cwq4.mjs

HighShelldist/cli/index.mjs

HighCredential Redirect Persistencedist/cli/index.mjs

HighExternal Ai Agent Control Surface Mutationdist/hooks/cleanup-session-files.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/index.mjs

HighCross File Remote Execution Contextdist/cli/index.mjs

Affected versions and remediation

This report applies to @tekmidian/pai@0.68.0.

See all versions of @tekmidian/pai for other recorded verdicts.

Review the evidence and your use of @tekmidian/pai@0.68.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 05:34:05.231Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.