Loading npm security reports…
XPI — offensive security tools for Pi Agent. Casefile tracking, web search, library docs, exploit technique search, code intelligence, todo tracking.
LPM treats this as warn-only first-party agent extension lifecycle risk. Install-time script modifies the user's Pi agent environment by installing/registering extensions and copying bundled agent definitions. This is an agent lifecycle/control-surface change, but source inspection did not show exfiltration, stealth persistence, destructive behavior, or remote payload execution beyond package-manager installs.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L75Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L75