registry / @xaccefy/pi-xpi / 0.1.5

@xaccefy/pi-xpi@0.1.5

XPI — offensive security tools for Pi Agent. Casefile tracking, web search, library docs, exploit technique search, code intelligence, todo tracking.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 4 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

3 flagged

package.jsonView file

Lines 50-81json

50 "@types/bun": "^1.3.14",

51 "typescript": "^6.0.3"

52 },

53 "peerDependencies": {

54 "@xaccefy/pi-casefile": "*",

55 "@xaccefy/pi-exploitsearch": "*",

56 "@xaccefy/pi-lookup": "*",

57 "@xaccefy/pi-codeintel": "*",

58 "@xaccefy/pi-xtodo": "*",

59 "@earendil-works/pi-ai": "*",

60 "@earendil-works/pi-coding-agent": "*",

61 "@earendil-works/pi-tui": "*"

62 },

63 "scripts": {

64 "test": "node --test packages/pi-casefile/test/ledger.test.ts packages/pi-lookup/test/websearch.test.ts packages/pi-codeintel/test/codeintel.test.ts packages/pi-xtodo/test/todo.test.ts",

65 "test:casefile": "node --test packages/pi-casefile/test/ledger.test.ts",

66 "test:lookup": "node --test packages/pi-lookup/test/websearch.test.ts",

67 "test:codeintel": "node --test packages/pi-codeintel/test/codeintel.test.ts",

68 "test:xtodo": "node --test packages/pi-xtodo/test/todo.test.ts",

69 "typecheck": "tsc --noEmit --project tsconfig.json",

70 "postinstall": "bash install.sh",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L70

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L70

71 "version:patch": "npm version patch -ws --no-git-tag-version && npm version patch --no-git-tag-version && node scripts/sync-versions.js",

72 "version:minor": "npm version minor -ws --no-git-tag-version && npm version minor --no-git-tag-version && node scripts/sync-versions.js",

73 "version:major": "npm version major -ws --no-git-tag-version && npm version major --no-git-tag-version && node scripts/sync-versions.js",

74 "publish:all": "npm publish -ws --access public && npm publish --access public",

75 "publish:dry": "npm publish -ws --access public --dry-run",

76 "release:patch": "node scripts/release.mjs patch",

77 "release:minor": "node scripts/release.mjs minor",

78 "release:major": "node scripts/release.mjs major"

79 }

80}

install.shView file

•path = install.sh kind = build_helper sizeBytes = 2609 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = bash install.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bash install.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 2609 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Findings

1 High2 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumShips Build Helperinstall.sh

LowScripts Present

Source & flagged code

3 flagged

package.jsonView file

Lines 50-81json

50 "@types/bun": "^1.3.14",

51 "typescript": "^6.0.3"

52 },

53 "peerDependencies": {

54 "@xaccefy/pi-casefile": "*",

55 "@xaccefy/pi-exploitsearch": "*",

56 "@xaccefy/pi-lookup": "*",

57 "@xaccefy/pi-codeintel": "*",

58 "@xaccefy/pi-xtodo": "*",

59 "@earendil-works/pi-ai": "*",

60 "@earendil-works/pi-coding-agent": "*",

61 "@earendil-works/pi-tui": "*"

62 },

63 "scripts": {

64 "test": "node --test packages/pi-casefile/test/ledger.test.ts packages/pi-lookup/test/websearch.test.ts packages/pi-codeintel/test/codeintel.test.ts packages/pi-xtodo/test/todo.test.ts",

65 "test:casefile": "node --test packages/pi-casefile/test/ledger.test.ts",

66 "test:lookup": "node --test packages/pi-lookup/test/websearch.test.ts",

67 "test:codeintel": "node --test packages/pi-codeintel/test/codeintel.test.ts",

68 "test:xtodo": "node --test packages/pi-xtodo/test/todo.test.ts",

69 "typecheck": "tsc --noEmit --project tsconfig.json",

70 "postinstall": "bash install.sh",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L70

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L70

71 "version:patch": "npm version patch -ws --no-git-tag-version && npm version patch --no-git-tag-version && node scripts/sync-versions.js",

72 "version:minor": "npm version minor -ws --no-git-tag-version && npm version minor --no-git-tag-version && node scripts/sync-versions.js",

73 "version:major": "npm version major -ws --no-git-tag-version && npm version major --no-git-tag-version && node scripts/sync-versions.js",

74 "publish:all": "npm publish -ws --access public && npm publish --access public",

75 "publish:dry": "npm publish -ws --access public --dry-run",

76 "release:patch": "node scripts/release.mjs patch",

77 "release:minor": "node scripts/release.mjs minor",

78 "release:major": "node scripts/release.mjs major"

79 }

80}

install.shView file

•path = install.sh kind = build_helper sizeBytes = 2609 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg