Loading npm security reports…
First-party Pi web tools: provider-toggled web search, Exa deep research, content retrieval, and OpenAI native web_search integration.
LPM flags this version as an AI-agent control-surface risk. An automatic npm postinstall modifies Pi's shared system instructions outside the package. Its fallback can affect existing user-level agent configuration even for ordinary npm installs.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackage.json automatically runs the system-instruction installer during postinstall.
package.jsonView on unpkg · L216Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe installer targets the shared APPEND_SYSTEM.md agent instruction file.
scripts/append-system.mjsView on unpkg · L59This report applies to @vanillagreen/pi-web-tools@2.0.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L216Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L216package.json automatically runs the system-instruction installer during postinstall.
package.jsonView on unpkg · L216The installer targets the shared APPEND_SYSTEM.md agent instruction file.
scripts/append-system.mjsView on unpkg · L59