registry / @tekmidian/pai / 1.0.5
@tekmidian/pai@1.0.5
⚠ Under reviewPAI Knowledge OS — Personal AI Infrastructure with federated memory and project management
AI Security Review
scanned 7h ago · by lpm-firewall-aiThe inspected package source does not establish malicious behavior, and the manifest has no npm install hook. The declared runtime tokenizer dependency could not be inspected, so its behavior remains unresolved.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
When the tokenizer-loading path imports the declared dependency.
Impact
The dependency boundary prevents confirming whether this runtime path is safe.
Mechanism
The package imports @huggingface/transformers to load a tokenizer; the imported dependency’s behavior remains unreviewed.
AI rationale
The inspected package source does not establish malicious behavior, and the manifest has no npm install hook. The declared runtime tokenizer dependency could not be inspected, so its behavior remains unresolved.
Evidence
package.jsondist/routing-BlD_tKjW.mjs
Decision evidence
public snapshotAI called this Manual Review at 82.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares @huggingface/transformers, and the routing module dynamically imports it when loading a tokenizer; that dependency’s source was unavailable in the supplied snapshot.
- The manifest defines prepublishOnly but no preinstall, install, or postinstall script.
Evidence against
- The inspected Todoist setup asks whether to enable the integration before requesting a token.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
14 flagged · loading sourcedist/project-setup-pIPHZaXf.mjsView file
28import { tmpdir } from "node:os";
L29: import { execFileSync, spawn } from "node:child_process";
L30: import { parse } from "yaml";
High
Child Process
Package source references child process execution.
dist/project-setup-pIPHZaXf.mjsView on unpkg · L2828import { tmpdir } from "node:os";
L29: import { execFileSync, spawn } from "node:child_process";
L30: import { parse } from "yaml";
...
L81: function agentsDir() {
L82: return join(claudeHomeDir(), "agents");
L83: }
...
L285: const HELP_MAX_MINUTES = 20;
L286: /** Exit code of a refused call. */
L287: const HELP_REFUSED_EXIT = 4;
...
L297: try {
L298: const e = JSON.parse(line);
L299: if (!scope || e.scope === scope) out.push(e);
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/project-setup-pIPHZaXf.mjsView on unpkg · L28dist/wait-ChpHKJZV.mjs#virtual:normalized:round1View file
59* The job behind a command line: strips `nohup`, the shell wrapper
L60: * (`sh -c "…"`), an interpreter prefix (`node`, `bash`) and the `; echo $? > rc`
L61: * trailer of the documented recipe, then shortens with an ellipsis at the end.
High
Shell
Package source references shell execution.
dist/wait-ChpHKJZV.mjs#virtual:normalized:round1View on unpkg · L59dist/indexer-backend-B2vtFl38.mjsView file
19import { homedir, setPriority, userInfo } from "node:os";
L20: import { spawn, spawnSync } from "node:child_process";
L21: import { copyFileSync as copyFileSync$1, existsSync as existsSync$1, linkSync as linkSync$1, mkdirSync as mkdirSync$1, readFileSync as readFileSync$1, readdirSync as readdirSync$1,...
...
L587: ...opts,
L588: body: effectiveBody
L589: });
...
L625: function getPaiDir() {
L626: const envDir = process.env.ADAPTER_DIR || process.env.PAI_DIR;
L627: if (envDir) try {
...
L631: }
L632: return claudeHomeDir();
L633: }
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/indexer-backend-B2vtFl38.mjsView on unpkg · L19dist/cli2/index.mjsView file
3886try {
L3887: return (await fetch(`http://127.0.0.1:${port}/v1/models`, { signal: AbortSignal.timeout(3e3) })).ok;
L3888: } catch {
...
L3897: const [cmd, ...args] = plan.argv;
L3898: const child = spawn(cmd, args, {
L3899: env: {
L3900: ...process.env,
L3901: ...plan.env
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cli2/index.mjsView on unpkg · L3886dist/cli/index.mjsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli/index.mjs:
import { appendFileSync, chmodSync, closeSync, copyFileSync, cpSync, createReadStream, createWriteStream, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readS...
import { createInterface } from "node:readline";
for (const p of pages) writeFileSync(join(dir, p.name), p.markdown);
writeFileSync(file, md + "\n");
writeFileSync(routerPidFile(), String(process.pid));
writeFileSync(routerHandoverFile(), String(process.pid));
writeFileSync(tmp, JSON.stringify(out), "utf-8");
* actual ~/.claude/projects/ (a live directory this very session writes to). */
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli/index.mjsView on unpkg•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
mplate.md");
if (!existssync(templatepath)) {
console.log(c.warn("skill template not found: " + templatepath));
console.log(c.dim(" skipping pai skill installation."));
return false;
}
const skilldir = join(homedir(), ".claude", "skills", "pai");
const skillfile = join(skilldir, "skill.md");
if (existssync(skillfile)) {
const content = readfilesync(skillfile, "utf-8");
const isgenerated = content.includes("generated by pai setup");
if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md."));
else {
console.log(c.yellow(" found existing skill.md (not pai-generated)."));
console.log(c.dim(" a backup will be created before overwriting
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/cli/index.mjsView on unpkg43Cross-file remote execution chain: dist/cli/index.mjs spawns dist/daemon-mcp/index.mjs; helper contains network access plus dynamic code execution.
L43: import { A as routerPidFile, B as usageContextTokens, D as routerHandoverFile, E as probeRouter, F as startHandover, I as paneWaiver, L as launchPane, M as routerSwapArgs, P as spa...
L44: import { C as readRunLog, D as resumeState, E as requestPlanStop, F as runLogPath, I as PlanTracker, M as dirtyConflicts, O as runExitCode, P as loadPlan, S as planStopPath, T as r...
L45: import "../endreason-BqyyU7BH.mjs";
...
L68: import { cpus, homedir, platform, userInfo } from "node:os";
L69: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L70: import { fileURLToPath } from "node:url";
L71: import http from
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/cli/index.mjsView on unpkg · L4343Trigger-reachable persistence chain: manifest.bin -> dist/cli/index.mjs
L43: import { A as routerPidFile, B as usageContextTokens, D as routerHandoverFile, E as probeRouter, F as startHandover, I as paneWaiver, L as launchPane, M as routerSwapArgs, P as spa...
L44: import { C as readRunLog, D as resumeState, E as requestPlanStop, F as runLogPath, I as PlanTracker, M as dirtyConflicts, O as runExitCode, P as loadPlan, S as planStopPath, T as r...
L45: import "../endreason-BqyyU7BH.mjs";
...
L68: import { cpus, homedir, platform, userInfo } from "node:os";
L69: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L70: import { fileURLToPath } from "node:url";
L71: import http from "node:http";
L72: import { createServer } from "node:net";
...
L107: stream.
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/cli/index.mjsView on unpkg · L43dist/routing-BlD_tKjW.mjsView file
19import { homedir, networkInterfaces, tmpdir } from "node:os";
L20: import { execFile, execFileSync, spawnSync } from "node:child_process";
L21: import { parse, stringify } from "yaml";
L22: import http from "node:http";
L23: import https from "node:https";
...
L86: push(chunk) {
L87: const text = chunk.toString("utf8");
L88: if (!this.mode) this.mode = /^\s*(event:|data:|:)/.test(text) ? "sse" : "json";
L89: if (this.mode === "json") {
...
L908: }
L909: const slotsDir = () => join(paiHomeDir(), "state", "strata-slots");
L910: async function httpPost(url, body) {
Critical
Download Execute
Source downloads or fetches remote code and executes it.
dist/routing-BlD_tKjW.mjsView on unpkg · L1919Trigger-reachable chain: manifest.bin -> dist/cli/index.mjs -> dist/routing-BlD_tKjW.mjs
L19: import { homedir, networkInterfaces, tmpdir } from "node:os";
L20: import { execFile, execFileSync, spawnSync } from "node:child_process";
L21: import { parse, stringify } from "yaml";
L22: import http from "node:http";
L23: import https from "node:https";
...
L86: push(chunk) {
L87: const text = chunk.toString("utf8");
L88: if (!this.mode) this.mode = /^\s*(event:|data:|:)/.test(text) ? "sse" : "json";
L89: if (this.mode === "json") {
...
L908: }
L909: const slotsDir = () => join(paiHomeDir(), "state", "strata-slots");
L910: async function httpPost(url, body) {
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/routing-BlD_tKjW.mjsView on unpkg · L19dist/hooks/capture-tool-output.mjsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
value = value.replace(/^~(?=\/|$)/, homedir2());
if (process.env[key] === void 0) {
process.env[key] = value;
}
}
}
break;
} catch {
}
}
}
}
loadenvfile();
function defaultadapterdir() {
return resolve(process.env.claude_config_dir || resolve(homedir2(), ".claude"));
}
function suppressdeprecationnotices() {
if (process.env.pai_quiet_notices === "1") return true;
const idx = process.argv.indexof("--output-format");
return idx !== -1 && process.argv[idx + 1] === "json";
}
function warnpaidirdeprecatedonce(message) {
const g = globalthis;
if (g.__paidirnoticeprinted || suppressdeprecationnotices()) return;
g
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/hooks/capture-tool-output.mjsView on unpkgtab-color-command.shView file
•path = tab-color-command.sh
kind = build_helper
sizeBytes = 860
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
tab-color-command.shView on unpkgdist/fallback-Bj2cyVk_.mjs#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/fallback-Bj2cyVk_.mjs#virtual:normalized:round1View on unpkgFindings
2 Critical9 High5 Medium7 Low
CriticalDownload Executedist/routing-BlD_tKjW.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/routing-BlD_tKjW.mjs
HighChild Processdist/project-setup-pIPHZaXf.mjs
HighShelldist/wait-ChpHKJZV.mjs#virtual:normalized:round1
HighSame File Env Network Executiondist/cli2/index.mjs
HighCredential Redirect Persistencedist/cli/index.mjs
HighExternal Ai Agent Control Surface Mutationdist/hooks/capture-tool-output.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/index.mjs
HighCross File Remote Execution Contextdist/cli/index.mjs
HighTrigger Reachable Persistencedist/cli/index.mjs
HighSemantic Analysis Limiteddist/fallback-Bj2cyVk_.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/indexer-backend-B2vtFl38.mjs
MediumShips Build Helpertab-color-command.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowWeak Cryptodist/project-setup-pIPHZaXf.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tekmidian/pai@1.0.5.
See all versions of @tekmidian/pai for other recorded verdicts.
- Review the evidence and your use of @tekmidian/pai@1.0.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.