registry / @twofive/snail-pi-web / 0.9.11

@twofive/snail-pi-web@0.9.11

⚠ Under review

Snail Pi Web (蜗牛派) workspace for the pi coding agent

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 20 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 228 file(s), 2.72 MB of source, external domains: 10.0.0.1, 10.0.0.5, 127.0.0.1, 169.254.169.254, 192.168.1.10, a.example, a.test, api.deepseek.com, api.example, api.example.com, api.openai.com, app.example.com, app.example.test, auth.openai.com, auth.x.ai, b.example, cdn.example, cdn.example.com, cdn.test, chatgpt.com, cli-chat-proxy.grok.com, closed.example, environment.invalid, evil.example, evil.localhost, example.com, example.invalid, example.test, html.duckduckgo.com, legacy.example, mcp.example.com, metadata.google.internal, other.example, owner.example, pi.dev, x.test

Source & flagged code

12 flagged

bin/pi-web.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @twofive/snail-pi-web@0.9.10 matchedIdentity = npm:QHR3b2ZpdmUvc25haWwtcGktd2Vi:0.9.10 similarity = 0.850 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/pi-web.jsView on unpkg

4// eslint-disable-next-line @typescript-eslint/no-require-imports L5: const { spawn } = require("child_process"); L6: // eslint-disable-next-line @typescript-eslint/no-require-imports

High

Child Process

Package source references child process execution.

bin/pi-web.jsView on unpkg · L4

4// eslint-disable-next-line @typescript-eslint/no-require-imports L5: const { spawn } = require("child_process"); L6: // eslint-disable-next-line @typescript-eslint/no-require-imports

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/pi-web.jsView on unpkg · L4

scripts/smoke-runtime-packaging.tsView file

86.join("\n"); L87: assert(!/shell\s*:\s*true/.test(executableSource), "published launcher must not spawn with shell: true"); L88: assert(launcher.includes('"explorer.exe"'), "Windows browser launch must use explorer.exe directly");

High

Shell

Package source references shell execution.

scripts/smoke-runtime-packaging.tsView on unpkg · L86

1Cross-file remote execution chain: scripts/smoke-runtime-packaging.ts spawns lib/automation-worker-runtime.cjs; helper contains network access plus dynamic code execution. L1: import { spawnSync } from "node:child_process"; L2: import { existsSync, readFileSync, statSync } from "node:fs"; ... L44: function checkNextSecurityBaseline(): void { L45: const pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8")) as { L46: dependencies?: Record<string, string>; ... L71: encoding: "utf8", L72: env: process.env, L73: }); L74: const helpText = `${help.stdout ?? ""}\n${help.stderr ?? ""}`; L75: assert(help.status === 0 || helpText.length > 0, "next start --help must be runnable");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/smoke-runtime-packaging.tsView on unpkg · L1

scripts/smoke-chrome-extension-artifacts.tsView file

2* Artifact-level smoke checks for extensions/chrome-tab-debug. L3: * Loads production extension files under a mocked Chrome/WebSocket/DOM environment. L4: * Does not duplicate production authorization/policy logic into the test. ... L9: L10: import { spawnSync } from "node:child_process"; L11: import { createHash, randomUUID } from "node:crypto"; ... L357: sent: string[] = []; L358: private listeners = new Map<string, Set<Listener>>(); L359: onClientSend: ((data: string) => void) | null = null; L360: ... L505: // Tiny 1x1 jpeg-ish payload under limits L506: return "data:image/jpeg;base64,/[redacted]...

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

scripts/smoke-chrome-extension-artifacts.tsView on unpkg · L2

scripts/smoke-automation-security-regressions.tsView file

3*/ L4: import { createServer } from "http"; L5: import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs"; ... L76: const agentDir = mkdtempSync(path.join(tmpdir(), "auto-sec-")); L77: process.env.PI_CODING_AGENT_DIR = agentDir; L78: ... L183: response.statusCode = 204; L184: response.end(); L185: }), ... L505: { L506: const bad = validateJsonlStructure(Buffer.from("not-json\n")); L507: assert(!bad.ok, "invalid jsonl rejected");

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

scripts/smoke-automation-security-regressions.tsView on unpkg · L3

scripts/run-automation-smokes.cjsView file

27console.log(`\n=== ${script} ===`); L28: const result = spawnSync("npx", ["--yes", "tsx@4.23.1", full], { L29: cwd: root,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/run-automation-smokes.cjsView on unpkg · L27

scripts/start-pi-web-proxy.ps1View file

•path = scripts/start-pi-web-proxy.ps1 kind = build_helper sizeBytes = 5275 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/start-pi-web-proxy.ps1View on unpkg

.next/server/app/favicon.ico.bodyView file

•path = .next/server/app/favicon.ico.body kind = high_entropy_blob sizeBytes = 22542 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/server/app/favicon.ico.bodyView on unpkg

•path = .next/server/app/favicon.ico.body kind = payload_in_excluded_dir sizeBytes = 22542 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/server/app/favicon.ico.bodyView on unpkg

lib/chatgpt-usage-refresh-scheduler.tsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/chatgpt-usage-refresh-scheduler.tsView on unpkg

@twofive/snail-pi-web@0.9.11

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code