registry / @tekmidian/pai / 0.71.2
@tekmidian/pai@0.71.2
⚠ Under reviewPAI Knowledge OS — Personal AI Infrastructure with federated memory and project management
AI Security Review
scanned 3d ago · by lpm-firewall-aiInspected source supports a local embedding feature and shows no confirmed attack. The selected runtime dependency could not be inspected, so the dependency review policy prevents a clean verdict.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Embedding or tokenizer work can load the runtime dependency; the manifest also declares it for installation.
Impact
The available source does not establish credential exposure or other malicious behavior; the unavailable dependency source prevents a clean determination.
Mechanism
The package dynamically imports the tokenizer library and retrieves a model from Hugging Face. The dependency implementation itself could not be reviewed in this snapshot.
AI rationale
Inspected source supports a local embedding feature and shows no confirmed attack. The selected runtime dependency could not be inspected, so the dependency review policy prevents a clean verdict.
Evidence
package.jsondist/embedding-gate-B4jwiqN2.mjs
Network endpoints1
huggingface.co/yixuan-chia/snowflake-arctic-embed-m-v1.5-GGUF/resolve/main/snowflake-arctic-embed-m-v1.5-F16.gguf
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest lists @huggingface/transformers as a runtime dependency, and the embedding module imports it when loading a tokenizer; that dependency’s source was unresolved in the supplied inspection snapshot.
- The manifest’s only lifecycle script is prepublishOnly, which is not an npm install hook.
- The inspected embedding code fetches a fixed model from Hugging Face and checks its size and SHA-256 before importing it into local Ollama.
Evidence against
- The inspected dynamic import is used for tokenizer loading during embedding work, not shown collecting or sending user credentials.
- The inspected model download is tied to local embedding setup and includes integrity checks.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
15 flagged · loading sourcedist/session-B3qJnaix.mjsView file
23import chalk, { Chalk } from "chalk";
L24: import { spawnSync } from "node:child_process";
L25: import { createInterface } from "node:readline";
High
Child Process
Package source references child process execution.
dist/session-B3qJnaix.mjsView on unpkg · L23dist/run-BF56afeQ.mjsView file
1501* iTerm's split command parameter execs without a shell (proven live: panes
L1502: * survive `sleep 30` and a single-quoted `/bin/sh -c`, die instantly on
L1503: * `export …; …` or a redirect), so the command must be one exec-able line.
High
dist/project-setup-Cu0Bumqv.mjsView file
9import { r as isLoopbackProvider } from "./run-env-DBJ8ml-Z.mjs";
L10: import { $ as waitingLine, D as bashExitCode, E as WAIT_EXIT_STILL_RUNNING, G as statusMarker, I as renderReport, J as detachedLine, K as statusQueue, O as isWaitPollCommand, P as ...
L11: import { E as probeLoopback, O as resolveLocalProvider, S as LOCAL_MECHANISM_LINE, k as resolveRunnerProvider } from "./budget-CuL0Q5aB.mjs";
...
L23: import { basename, dirname, join, relative, resolve } from "node:path";
L24: import { execFileSync, spawn } from "node:child_process";
L25: import { Document, parse } from "yaml";
...
L78: function agentsDir() {
L79: return join(homedir(), ".claude", "agents");
L80: }
...
L499: /**
L500: * `HH:MM:SS` at an offset east of UTC in minutes (Date.getTimezoneOffset()
L501: * negated), fro
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/project-setup-Cu0Bumqv.mjsView on unpkg · L9dist/indexer-backend-DxI_YJf1.mjsView file
14import { basename, delimiter, dirname, join } from "node:path";
L15: import { spawn, spawnSync } from "node:child_process";
L16: import { randomUUID } from "node:crypto";
...
L542: ...opts,
L543: body: effectiveBody
L544: });
...
L580: function getPaiDir() {
L581: const envDir = process.env.ADAPTER_DIR || process.env.PAI_DIR;
L582: if (envDir) try {
...
L586: }
L587: return join(homedir(), ".claude");
L588: }
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/indexer-backend-DxI_YJf1.mjsView on unpkg · L14dist/cli/index.mjsView file
1861try {
L1862: return (await fetch(`http://127.0.0.1:${port}/v1/models`, { signal: AbortSignal.timeout(3e3) })).ok;
L1863: } catch {
...
L1872: const [cmd, ...args] = plan.argv;
L1873: const child = spawn(cmd, args, {
L1874: env: {
L1875: ...process.env,
L1876: ...plan.env
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli/index.mjsView on unpkg · L1861•Trigger-reachable chain: manifest.bin -> dist/cli/index.mjs
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cli/index.mjsView on unpkg•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli/index.mjs:
import { appendFileSync, chmodSync, closeSync, copyFileSync, cpSync, createReadStream, createWriteStream, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readS...
import { createInterface } from "node:readline";
for (const p of pages) writeFileSync(join(dir, p.name), p.markdown);
writeFileSync(file, md + "\n");
if (!existsSync(envFile)) writeFileSync(envFile, "arm load thermal\n");
writeFileSync(file, `# A/B results\n\nGenerated by \`pai worker bench\`; void rows excluded from pass/total.\n\n${aggregate(rows)}\n`);
const SETTINGS_FILE = join(join(homedir(), ".claude"), "settings.json");
* ~/.cla
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli/index.mjsView on unpkg•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
dir(), "pai-sk[redacted]");
if (!existssync(templatepath)) {
console.log(c.warn("skill template not found: " + templatepath));
console.log(c.dim(" skipping pai skill installation."));
return false;
}
const skilldir = join(homedir(), ".claude", "skills", "pai");
const skillfile = join(skilldir, "skill.md");
if (existssync(skillfile)) {
const content = readfilesync(skillfile, "utf-8");
const isgenerated = content.includes("generated by pai setup");
if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md."));
else {
console.log(c.yellow(" found existing skill.md (not pai-generated)."));
console.log(c.dim(" a backup will be created bef
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/cli/index.mjsView on unpkg3Cross-file remote execution chain: dist/cli/index.mjs spawns dist/daemon-mcp/index.mjs; helper contains network access plus dynamic code execution.
L3: import { a as slugify$1, i as parseSessionFilename } from "../migrate-B1t833CE.mjs";
L4: import { $ as workersYamlPath, A as nativeAnthropicProvider, At as resumeState, B as readWorkersSection, Cn as effectiveCap, Dn as reorderQueue, Dt as renderSchedule, E as isLocalP...
L5: import { a as schedulerLogPath, c as migratePaiFile, d as resolvePaiFile, i as paiSocketPath, l as paiHomeDir, n as daemonLogPath, o as PaiFileMigrationError, s as migratePaiDir, u...
...
L48: import chalk from "chalk";
L49: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L50: import { parseDocument } from "yaml";
L51: import {
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/cli/index.mjsView on unpkg · L33Trigger-reachable persistence chain: manifest.bin -> dist/cli/index.mjs
L3: import { a as slugify$1, i as parseSessionFilename } from "../migrate-B1t833CE.mjs";
L4: import { $ as workersYamlPath, A as nativeAnthropicProvider, At as resumeState, B as readWorkersSection, Cn as effectiveCap, Dn as reorderQueue, Dt as renderSchedule, E as isLocalP...
L5: import { a as schedulerLogPath, c as migratePaiFile, d as resolvePaiFile, i as paiSocketPath, l as paiHomeDir, n as daemonLogPath, o as PaiFileMigrationError, s as migratePaiDir, u...
...
L48: import chalk from "chalk";
L49: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L50: import { parseDocument } from "yaml";
L51: import { createHash, randomBytes, randomUUID } from "node:crypto";
L52: import http f
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/cli/index.mjsView on unpkg · L3dist/embedding-gate-B4jwiqN2.mjsView file
5Source sends the broad process environment to a literal external destination.
L5: import { join } from "node:path";
L6: import { execFileSync } from "node:child_process";
L7: import { createHash } from "node:crypto";
...
L64: const OLLAMA_DEFAULT_MODEL = "arctic-embed-m-v1.5-f16";
L65: const OLLAMA_DEFAULT_URL = "http://127.0.0.1:11434";
L66: const TOKENIZER_MODEL = "Snowflake/snowflake-arctic-embed-m-v1.5";
...
L109: };
L110: names = (await r.json()).models?.map((m) => m.name) ?? [];
L111: } catch {
...
L128: const f = deps.fetch ?? fetch;
L129: const log = deps.log ?? ((m) => process.stderr.write(`${m}\n`));
L130: const getTok = deps.tokenizer ?? loadTokenizer;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/embedding-gate-B4jwiqN2.mjsView on unpkg · L5dist/hooks/cleanup-session-files.mjsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
replace(/\$home/g, homedir2());
value = value.replace(/^~(?=\/|$)/, homedir2());
if (process.env[key] === void 0) {
process.env[key] = value;
}
}
}
break;
} catch {
}
}
}
}
loadenvfile();
function defaultadapterdir() {
return resolve(homedir2(), ".claude");
}
function suppressdeprecationnotices() {
if (process.env.pai_quiet_notices === "1") return true;
const idx = process.argv.indexof("--output-format");
return idx !== -1 && process.argv[idx + 1] === "json";
}
function warnpaidirdeprecatedonce(message) {
const g = globalthis;
if (g.__paidirnoticeprinted || suppressdeprecationnotices()) return;
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/hooks/cleanup-session-files.mjsView on unpkgtab-color-command.shView file
•path = tab-color-command.sh
kind = build_helper
sizeBytes = 860
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
tab-color-command.shView on unpkgdist/launch-BCawmJrT.mjs#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 13
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/launch-BCawmJrT.mjs#virtual:normalized:round1View on unpkgdist/hooks/supervision-banner.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @tekmidian/pai@0.71.1
matchedIdentity = npm:QHRla21pZGlhbi9wYWk:0.71.1
similarity = 0.692
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/hooks/supervision-banner.mjsView on unpkgFindings
4 Critical8 High5 Medium7 Low
CriticalSame File Env Network Executiondist/cli/index.mjs
CriticalHardcoded Runtime Data Exfiltrationdist/embedding-gate-B4jwiqN2.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/cli/index.mjs
CriticalPrevious Version Dangerous Deltadist/hooks/supervision-banner.mjs
HighChild Processdist/session-B3qJnaix.mjs
HighShelldist/run-BF56afeQ.mjs
HighCredential Redirect Persistencedist/cli/index.mjs
HighExternal Ai Agent Control Surface Mutationdist/hooks/cleanup-session-files.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/index.mjs
HighCross File Remote Execution Contextdist/cli/index.mjs
HighTrigger Reachable Persistencedist/cli/index.mjs
HighSemantic Analysis Limiteddist/launch-BCawmJrT.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/indexer-backend-DxI_YJf1.mjs
MediumShips Build Helpertab-color-command.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowWeak Cryptodist/project-setup-Cu0Bumqv.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tekmidian/pai@0.71.2.
See all versions of @tekmidian/pai for other recorded verdicts.
- Review the evidence and your use of @tekmidian/pai@0.71.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.