@tekmidian/pai@0.71.3

PAI Knowledge OS — Personal AI Infrastructure with federated memory and project management

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The scanner's high-risk matches resolve to product behavior in the inspected source: a model download, explicitly configured provider and Todoist clients, and a topic-gated project notification. No malicious behavior or unconsented install-time mutation was established.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Running the relevant CLI or daemon feature, configuring a notification topic, or explicitly setting up the agent integration; npm installation alone does not trigger the inspected behavior.

Impact

No covert credential transfer, destructive action, or unconsented install-time control-surface change was established.

Mechanism

The CLI setup prompts before changing agent settings. Provider credentials go to configured providers, Todoist requests use the Todoist API, and project notifications require a configured topic.

AI rationale

Network endpoints2

api.todoist.com/api/v1ntfy.sh/{configured topic}

Decision evidence

public snapshot

AI called this Clean at 89.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

package.json has only a prepublishOnly lifecycle script; it builds the package and runs a worker gate, so it is not an npm install hook.
CLI setup presents a prompt before patching Claude settings, and the core hook manifest registers the supervision banner only for startup or compaction. The banner reads a matching local manager record and returns nothing when the session is absent, paused, or expired.
Provider setup accepts a caller-supplied URL and key. The task-bus setup asks before adopting TODOIST_API_KEY, and its request client sends the token to the Todoist API.
The project-start notification is sent only when NTFY_TOPIC is configured, and its message contains the project name.
The flagged embedding fetch uses GGUF_URL; the inspected code treats it as a model download rather than a credential request.
The inspected runtime paths support worker routing, project and session handling, and local memory operations; the memory-search path saves query metadata and dispatches the requested tool.

Evidence against

The source does not establish an npm install-time trigger for the flagged behavior.
The inspected network calls have product functions and configured destinations; no credential transfer to a publisher-controlled receiver was established.

Source & flagged code

15 flagged

dist/session-B3qJnaix.mjsView file

23import chalk, { Chalk } from "chalk"; L24: import { spawnSync } from "node:child_process"; L25: import { createInterface } from "node:readline";

High

Child Process

Package source references child process execution.

dist/session-B3qJnaix.mjsView on unpkg · L23

dist/run-BF56afeQ.mjsView file

1501* iTerm's split command parameter execs without a shell (proven live: panes L1502: * survive `sleep 30` and a single-quoted `/bin/sh -c`, die instantly on L1503: * `export …; …` or a redirect), so the command must be one exec-able line.

High

Shell

Package source references shell execution.

dist/run-BF56afeQ.mjsView on unpkg · L1501

dist/project-setup-Cu0Bumqv.mjsView file

9import { r as isLoopbackProvider } from "./run-env-DBJ8ml-Z.mjs"; L10: import { $ as waitingLine, D as bashExitCode, E as WAIT_EXIT_STILL_RUNNING, G as statusMarker, I as renderReport, J as detachedLine, K as statusQueue, O as isWaitPollCommand, P as ... L11: import { E as probeLoopback, O as resolveLocalProvider, S as LOCAL_MECHANISM_LINE, k as resolveRunnerProvider } from "./budget-CuL0Q5aB.mjs"; ... L23: import { basename, dirname, join, relative, resolve } from "node:path"; L24: import { execFileSync, spawn } from "node:child_process"; L25: import { Document, parse } from "yaml"; ... L78: function agentsDir() { L79: return join(homedir(), ".claude", "agents"); L80: } ... L499: /** L500: * `HH:MM:SS` at an offset east of UTC in minutes (Date.getTimezoneOffset() L501: * negated), fro

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/project-setup-Cu0Bumqv.mjsView on unpkg · L9

dist/indexer-backend-DxI_YJf1.mjsView file

14import { basename, delimiter, dirname, join } from "node:path"; L15: import { spawn, spawnSync } from "node:child_process"; L16: import { randomUUID } from "node:crypto"; ... L542: ...opts, L543: body: effectiveBody L544: }); ... L580: function getPaiDir() { L581: const envDir = process.env.ADAPTER_DIR || process.env.PAI_DIR; L582: if (envDir) try { ... L586: } L587: return join(homedir(), ".claude"); L588: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/indexer-backend-DxI_YJf1.mjsView on unpkg · L14

dist/cli/index.mjsView file

1861try { L1862: return (await fetch(`http://127.0.0.1:${port}/v1/models`, { signal: AbortSignal.timeout(3e3) })).ok; L1863: } catch { ... L1872: const [cmd, ...args] = plan.argv; L1873: const child = spawn(cmd, args, { L1874: env: { L1875: ...process.env, L1876: ...plan.env

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli/index.mjsView on unpkg · L1861

•Trigger-reachable chain: manifest.bin -> dist/cli/index.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/index.mjsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli/index.mjs: import { appendFileSync, chmodSync, closeSync, copyFileSync, cpSync, createReadStream, createWriteStream, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readS... import { createInterface } from "node:readline"; for (const p of pages) writeFileSync(join(dir, p.name), p.markdown); writeFileSync(file, md + "\n"); if (!existsSync(envFile)) writeFileSync(envFile, "arm load thermal\n"); writeFileSync(file, `# A/B results\n\nGenerated by \`pai worker bench\`; void rows excluded from pass/total.\n\n${aggregate(rows)}\n`); const SETTINGS_FILE = join(join(homedir(), ".claude"), "settings.json"); * ~/.cla

dist/embedding-gate-B4jwiqN2.mjsView file

5Source sends the broad process environment to a literal external destination. L5: import { join } from "node:path"; L6: import { execFileSync } from "node:child_process"; L7: import { createHash } from "node:crypto"; ... L64: const OLLAMA_DEFAULT_MODEL = "arctic-embed-m-v1.5-f16"; L65: const OLLAMA_DEFAULT_URL = "http://127.0.0.1:11434"; L66: const TOKENIZER_MODEL = "Snowflake/snowflake-arctic-embed-m-v1.5"; ... L109: }; L110: names = (await r.json()).models?.map((m) => m.name) ?? []; L111: } catch { ... L128: const f = deps.fetch ?? fetch; L129: const log = deps.log ?? ((m) => process.stderr.write(`${m}\n`)); L130: const getTok = deps.tokenizer ?? loadTokenizer;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/embedding-gate-B4jwiqN2.mjsView on unpkg · L5

dist/hooks/cleanup-session-files.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: replace(/\$home/g, homedir2()); value = value.replace(/^~(?=\/|$)/, homedir2()); if (process.env[key] === void 0) { process.env[key] = value; } } } break; } catch { } } } } loadenvfile(); function defaultadapterdir() { return resolve(homedir2(), ".claude"); } function suppressdeprecationnotices() { if (process.env.pai_quiet_notices === "1") return true; const idx = process.argv.indexof("--output-format"); return idx !== -1 && process.argv[idx + 1] === "json"; } function warnpaidirdeprecatedonce(message) { const g = globalthis; if (g.__paidirnoticeprinted || suppressdeprecationnotices()) return;

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/hooks/cleanup-session-files.mjsView on unpkg

tab-color-command.shView file

•path = tab-color-command.sh kind = build_helper sizeBytes = 860 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tab-color-command.shView on unpkg

dist/launch-BCawmJrT.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 13

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/launch-BCawmJrT.mjs#virtual:normalized:round1View on unpkg

dist/hooks/supervision-banner.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tekmidian/pai@0.71.1 matchedIdentity = npm:QHRla21pZGlhbi9wYWk:0.71.1 similarity = 0.675 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/hooks/supervision-banner.mjsView on unpkg

Source & flagged code

15 flagged · loading source

dist/session-B3qJnaix.mjsView file

23import chalk, { Chalk } from "chalk"; L24: import { spawnSync } from "node:child_process"; L25: import { createInterface } from "node:readline";

High

Child Process

Package source references child process execution.

dist/session-B3qJnaix.mjsView on unpkg · L23

dist/run-BF56afeQ.mjsView file

High

Shell

Package source references shell execution.

dist/run-BF56afeQ.mjsView on unpkg · L1501

dist/project-setup-Cu0Bumqv.mjsView file

Findings

4 Critical8 High5 Medium7 Low

CriticalSame File Env Network Executiondist/cli/index.mjs

CriticalHardcoded Runtime Data Exfiltrationdist/embedding-gate-B4jwiqN2.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/cli/index.mjs

CriticalPrevious Version Dangerous Deltadist/hooks/supervision-banner.mjs

HighChild Processdist/session-B3qJnaix.mjs

HighShelldist/run-BF56afeQ.mjs

HighCredential Redirect Persistencedist/cli/index.mjs

HighExternal Ai Agent Control Surface Mutationdist/hooks/cleanup-session-files.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/index.mjs

HighCross File Remote Execution Contextdist/cli/index.mjs

Affected versions and remediation

This report applies to @tekmidian/pai@0.71.3.

See all versions of @tekmidian/pai for other recorded verdicts.

Review the evidence and your use of @tekmidian/pai@0.71.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 02:48:44.215Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code