registry / @thed24/pi-ui / 0.5.3

@thed24/pi-ui@0.5.3

Web UI for the pi coding agent — runs in your browser, served from a Raspberry Pi or any Bun-capable machine.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package starts a password-gated local web UI and offers user-triggered package update operations.

Static reason

No blocking static signals were detected.

Trigger

User runs `pi-ui` or invokes its authenticated update functionality.

Impact

Expected local agent UI behavior; no unconsented installation-time mutation, persistence, or exfiltration identified.

Mechanism

Local Bun server, WebSocket bridge, and explicit package-manager update commands.

Rationale

Direct inspection shows a user-invoked Bun CLI and password-protected local UI, with explicit update functionality and an npm version-check endpoint. No install-time execution, secret exfiltration, foreign AI-agent control-surface mutation, hidden payload execution, or destructive behavior was found.

Evidence

package.jsonbin/pifrontier.tsserver.tsserver.bundle.jsbuild/client/service-worker.jsbuild/client/_app/immutable/nodes/4.DTnuJsne.jsbin/pifrontier

Network endpoints1

registry.npmjs.org/${encoded}/latest

Decision evidence

public snapshot

@thed24/pi-ui@0.5.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code