registry / @tekmidian/pai / 1.0.6
@tekmidian/pai@1.0.6
⚠ Under reviewPAI Knowledge OS — Personal AI Infrastructure with federated memory and project management
AI Security Review
scanned 3h ago · by lpm-firewall-aiThe inspected evidence does not support the scanner’s reverse-shell or credential-redirect claims: the generated rule detects suspicious shell commands, and the inspected token flow targets Todoist. Other runtime and agent-configuration paths remain unresolved, so a clean verdict is not established.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Not established from the inspected source.
Impact
No concrete attack impact was established from the inspected excerpts.
Mechanism
The inspected setup sends a Todoist token to the Todoist API and a hook records selected tool data locally; broader runtime behavior was not resolved.
AI rationale
The inspected evidence does not support the scanner’s reverse-shell or credential-redirect claims: the generated rule detects suspicious shell commands, and the inspected token flow targets Todoist. Other runtime and agent-configuration paths remain unresolved, so a clean verdict is not established.
Evidence
package.jsondist/cli/index.mjsdist/hooks/capture-tool-output.mjssrc/hooks/ts/lib/rules/builtin.generated.ts
Network endpoints1
api.todoist.com/api/v1
Decision evidence
public snapshotAI called this Manual Review at 68.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json shows no install lifecycle hook; its only listed lifecycle-like script is prepublishOnly.
- The inspected Todoist setup prompts for a token and the API client sends it to api.todoist.com.
- The generated shell rule is a detection pattern for decoded payloads piped into a shell, not reverse-shell execution.
- The tool-output hook records selected tool input and output locally after receiving hook data.
Evidence against
- Several runtime and agent-configuration paths remain unresolved, so the inspected excerpts do not establish the package’s full behavior.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
15 flagged · loading sourcedist/kill-tree-DPiMscaY.mjsView file
9import { homedir } from "node:os";
L10: import { execFileSync } from "node:child_process";
L11:
High
Child Process
Package source references child process execution.
dist/kill-tree-DPiMscaY.mjsView on unpkg · L9dist/cli/index.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @tekmidian/pai@1.0.8
matchedIdentity = npm:QHRla21pZGlhbi9wYWk:1.0.8
similarity = 0.842
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli/index.mjsView on unpkg10751summary: "Run a command in a visible pane and wait for it",
L10752: description: "Opens one pane (split of this window, never a new window) FIRST and runs the command in it as the child of `pai pane exec`, which shows the live output and its exit c...
L10753: options: [{
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli/index.mjs:
import { appendFileSync, chmodSync, closeSync, copyFileSync, cpSync, createReadStream, createWriteStream, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readS...
import { createInterface } from "node:readline";
for (const p of pages) writeFileSync(join(dir, p.name), p.markdown);
writeFileSync(file, md + "\n");
writeFileSync(routerPidFile(), String(process.pid));
writeFileSync(routerHandoverFile(), String(process.pid));
writeFileSync(tmp, JSON.stringify(out), "utf-8");
* actual ~/.claude/projects/ (a live directory this very session writes to). */
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli/index.mjsView on unpkg•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
mplate.md");
if (!existssync(templatepath)) {
console.log(c.warn("skill template not found: " + templatepath));
console.log(c.dim(" skipping pai skill installation."));
return false;
}
const skilldir = join(homedir(), ".claude", "skills", "pai");
const skillfile = join(skilldir, "skill.md");
if (existssync(skillfile)) {
const content = readfilesync(skillfile, "utf-8");
const isgenerated = content.includes("generated by pai setup");
if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md."));
else {
console.log(c.yellow(" found existing skill.md (not pai-generated)."));
console.log(c.dim(" a backup will be created before overwriting
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/cli/index.mjsView on unpkg43Cross-file remote execution chain: dist/cli/index.mjs spawns dist/daemon-mcp/index.mjs; helper contains network access plus dynamic code execution.
L43: import { A as routerPidFile, B as usageContextTokens, D as routerHandoverFile, E as probeRouter, F as startHandover, I as paneWaiver, L as launchPane, M as routerSwapArgs, P as spa...
L44: import { C as readRunLog, D as resumeState, E as requestPlanStop, F as runLogPath, I as PlanTracker, M as dirtyConflicts, O as runExitCode, Ot as runPaneExec, P as loadPlan, S as p...
L45: import "../endreason-C2-hYK0_.mjs";
...
L68: import { cpus, homedir, platform, userInfo } from "node:os";
L69: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L70: import { fileURLToPath } from "node:url";
L71: import http from
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/cli/index.mjsView on unpkg · L4343Trigger-reachable persistence chain: manifest.bin -> dist/cli/index.mjs
L43: import { A as routerPidFile, B as usageContextTokens, D as routerHandoverFile, E as probeRouter, F as startHandover, I as paneWaiver, L as launchPane, M as routerSwapArgs, P as spa...
L44: import { C as readRunLog, D as resumeState, E as requestPlanStop, F as runLogPath, I as PlanTracker, M as dirtyConflicts, O as runExitCode, Ot as runPaneExec, P as loadPlan, S as p...
L45: import "../endreason-C2-hYK0_.mjs";
...
L68: import { cpus, homedir, platform, userInfo } from "node:os";
L69: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L70: import { fileURLToPath } from "node:url";
L71: import http from "node:http";
L72: import { createServer } from "node:net";
...
L107: stream.
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/cli/index.mjsView on unpkg · L4343import { A as routerPidFile, B as usageContextTokens, D as routerHandoverFile, E as probeRouter, F as startHandover, I as paneWaiver, L as launchPane, M as routerSwapArgs, P as spa...
L44: import { C as readRunLog, D as resumeState, E as requestPlanStop, F as runLogPath, I as PlanTracker, M as dirtyConflicts, O as runExitCode, Ot as runPaneExec, P as loadPlan, S as p...
L45: import "../endreason-C2-hYK0_.mjs";
...
L68: import { cpus, homedir, platform, userInfo } from "node:os";
L69: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L70: import { fileURLToPath } from "node:url";
L71: import http from "node:http";
L72: import { createServer } from "node:net";
...
L107: stream.once("close", () => resolve());
L108: stream.write("", () => resolve());
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/cli/index.mjsView on unpkg · L43src/hooks/ts/lib/transcript-scan.tsView file
105if (existsSync(cfile)) {
L106: const c = JSON.parse(readFileSync(cfile, "utf-8")) as ScanCache<S>;
L107: if (
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/hooks/ts/lib/transcript-scan.tsView on unpkg · L105src/hooks/ts/lib/rules/builtin.generated.tsView file
6{
L7: "id": "base64-decode-to-shell",
L8: "severity": "block",
...
L65: "match": [
L66: "cat ~/.ssh/id_rsa",
L67: "cp ~/.aws/credentials /tmp/aws",
...
L101: "cat ~/.ssh/id_rsa",
L102: "curl https://example.com/upload"
L103: ],
...
L122: {
L123: "id": "crontab-persistence",
L124: "severity": "confirm",
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
src/hooks/ts/lib/rules/builtin.generated.tsView on unpkg · L6dist/routing-aJKMIagQ.mjsView file
19import { homedir, networkInterfaces, tmpdir } from "node:os";
L20: import { execFile, execFileSync, spawnSync } from "node:child_process";
L21: import { parse, stringify } from "yaml";
L22: import http from "node:http";
L23: import https from "node:https";
...
L86: push(chunk) {
L87: const text = chunk.toString("utf8");
L88: if (!this.mode) this.mode = /^\s*(event:|data:|:)/.test(text) ? "sse" : "json";
L89: if (this.mode === "json") {
...
L908: }
L909: const slotsDir = () => join(paiHomeDir(), "state", "strata-slots");
L910: async function httpPost(url, body) {
Critical
Download Execute
Source downloads or fetches remote code and executes it.
dist/routing-aJKMIagQ.mjsView on unpkg · L19dist/hooks/capture-tool-output.mjsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
value = value.replace(/^~(?=\/|$)/, homedir2());
if (process.env[key] === void 0) {
process.env[key] = value;
}
}
}
break;
} catch {
}
}
}
}
loadenvfile();
function defaultadapterdir() {
return resolve(process.env.claude_config_dir || resolve(homedir2(), ".claude"));
}
function suppressdeprecationnotices() {
if (process.env.pai_quiet_notices === "1") return true;
const idx = process.argv.indexof("--output-format");
return idx !== -1 && process.argv[idx + 1] === "json";
}
function warnpaidirdeprecatedonce(message) {
const g = globalthis;
if (g.__paidirnoticeprinted || suppressdeprecationnotices()) return;
g
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/hooks/capture-tool-output.mjsView on unpkgdist/render-jPpMrudf.mjsView file
6Trigger-reachable chain: manifest.bin -> dist/cli/index.mjs -> dist/render-jPpMrudf.mjs
L6: import { p as currentWorkerId, u as sessionTag } from "./scope-BTWstJ1B.mjs";
L7: import { A as waitOnCallLine, E as detachedLine, M as waitingLine, d as parseWorkerReport, j as waitOnResultLine, k as realWaitDeps, n as bashExitCode, p as renderReport, t as WAIT...
L8: import { g as sessionOf, l as queuedPaneLine, u as queuedText } from "./capacity-B2PgKAg4.mjs";
...
L13: import { homedir } from "node:os";
L14: import { execFileSync, spawn } from "node:child_process";
L15: import { fileURLToPath } from "node:url";
...
L20: /** The worker this process runs inside, when it runs inside one. */
L21: function parentFromEnv(env = process.env) {
L22: const id = currentWorkerId(env);
...
L181: function comm
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/render-jPpMrudf.mjsView on unpkg · L6tab-color-command.shView file
•path = tab-color-command.sh
kind = build_helper
sizeBytes = 860
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
tab-color-command.shView on unpkgdist/fallback-CwPSCrX8.mjs#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/fallback-CwPSCrX8.mjs#virtual:normalized:round1View on unpkgFindings
4 Critical8 High5 Medium7 Low
CriticalReverse Shellsrc/hooks/ts/lib/rules/builtin.generated.ts
CriticalDownload Executedist/routing-aJKMIagQ.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/render-jPpMrudf.mjs
CriticalPrevious Version Dangerous Deltadist/cli/index.mjs
HighChild Processdist/kill-tree-DPiMscaY.mjs
HighShelldist/cli/index.mjs
HighCredential Redirect Persistencedist/cli/index.mjs
HighExternal Ai Agent Control Surface Mutationdist/hooks/capture-tool-output.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/index.mjs
HighCross File Remote Execution Contextdist/cli/index.mjs
HighTrigger Reachable Persistencedist/cli/index.mjs
HighSemantic Analysis Limiteddist/fallback-CwPSCrX8.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli/index.mjs
MediumShips Build Helpertab-color-command.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowWeak Cryptosrc/hooks/ts/lib/transcript-scan.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tekmidian/pai@1.0.6.
See all versions of @tekmidian/pai for other recorded verdicts.
- Review the evidence and your use of @tekmidian/pai@1.0.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.