@vanillagreen/pi-task-panel@3.0.4: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@vanillagreen/pi-task-panel@3.0.4: Suspicious npm security report | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/append-system.mjs install

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/append-system.mjs install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

19"scripts": { "test": "bun test ./tests", "postinstall": "node scripts/append-system.mjs install", "preuninstall": "node scripts/append-system.mjs remove" }, "kende

Medium

Ai Review Evidence

package.json automatically runs instruction setup after installation and removal before uninstall.

package.jsonView on unpkg · L19

scripts/append-system.mjsView file

66const target = join(scopeRoot, "APPEND_SYSTEM.md"); const begin = ``; const end = `<!-- kendex:append-system ${name}

Medium

Suspicious Lifecycle Evidence

The lifecycle helper targets Pi's APPEND_SYSTEM.md using package-specific block markers.

scripts/append-system.mjsView on unpkg · L66

113const configured = process.env.PI_CODING_AGENT_DIR; const piDir = configured ? resolve(configured.replace(/^~(?=\/|$)/, homedir())) : join(homedir(), ".pi", "agent"); return existsSync(piDir) ? piDir : undefined; } function isPiScopeRoot(scopeRoot) { if (

Medium

Ai Review Evidence

Scope resolution falls back to an existing Pi user directory without a separate consent gate.

scripts/append-system.mjsView on unpkg · L113

143function upsertBlock(target, begin, end, content) { mkdirSync(dirname(target), { recursive: true }); const stripped = strippedExisting(target, begin, end); const block = `${begin}\n${content}\n${end}`; const next = stripped ? `${stripped}\n\n${block}\n` : `${block}\n`; writeFileSync(target, next); } function removeBlock(

Medium

Ai Review Evidence

The helper writes the instruction block and removes it during uninstall.

scripts/append-system.mjsView on unpkg · L143

84if (!content) { notice("source-empty", sourcePath, `The appendSystem source for ${name} is empty.`); process.exit(0); } upsertBlock(target, begin, end, content); } else { removeBlock(target, begin, end); } } catch

Source & flagged code

7 flagged

package.jsonView file

Lines 1-41json

1{

2 "name": "@vanillagreen/pi-task-panel",

3 "version": "3.0.4",

4 "description": "Persistent Claude-style tasks panel for Pi with slash commands and a structured tasks_write tool.",

5 "license": "MIT",

6 "keywords": [

7 "pi-package",

8 "pi",

9 "coding-agent",

10 "tasks"

11 ],

12 "pi": {

13 "extensions": [

14 "./extensions/task-panel.ts"

15 ],

16 "image": "https://raw.githubusercontent.com/vanillagreencom/kendex/main/pi-extensions/pi-task-panel/assets/panel-expanded.png",

17 "appendSystem": "./instructions.md"

18 },

19 "scripts": {

20 "test": "bun test ./tests",

21 "postinstall": "node scripts/append-system.mjs install",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "preuninstall": "node scripts/append-system.mjs remove"

23 },

24 "kendex": {

Medium

Ai Review Evidence

package.json automatically runs instruction setup after installation and removal before uninstall.

package.jsonView on unpkg · L19

25 "extensionManager": {

26 "displayName": "Task Panel",

27 "settings": [

28 {

29 "key": "enabled",

30 "label": "Enable task panel",

31 "description": "Register tasks_write, /tasks, task panel widgets, reminders, and shortcuts.",

32 "type": "boolean",

33 "default": true,

34 "category": "General",

35 "apply": "reload",

36 "requiresReload": true

37 },

38 {

39 "key": "glyphStyle",

40 "label": "Glyph style",

41 "description": "Glyphs for kendex-owned UI chrome. Unicode is the default; ASCII uses plain box/status/separator characters for terminal compatibility. pi-tool-renderer's global override wins when set.",

scripts/append-system.mjsView file

Lines 46-163javascript

46try {

47 pkg = JSON.parse(readFileSync(join(pkgDir, "package.json"), "utf8"));

48} catch (err) {

49 notice("package-read"