registry / @xaccefy/pi-xpi / 0.9.0

@xaccefy/pi-xpi@0.9.0

XPI — offensive security tools for Pi Agent. Casefile tracking, web search, library docs, exploit technique search, and todo tracking.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 397 KB of source, external domains: 127.0.0.1, api.preview.is, context7.com, mcp.deepwiki.com

Source & flagged code

3 flagged

packages/pi-casefile/src/pipeline-submit.tsView file

Lines 194-234typescript

194

195type FindingRef = {

196 key: string;

197 file: string;

198 line?: number;

199 endpoint?: string;

200 vuln_class: string;

201};

202

203type SubmitState = {

204 repairs: Record<string, number>;

205 accepted_findings: FindingRef[];

206};

207

208function statePath(runId: string): string {

209 return join(getRunDir(runId), "pipeline-submit.json");

210}

211

212function readState(runId: string): SubmitState {

213 const p = statePath(runId);

214 if (!existsSync(p)) return { repairs: {}, accepted_findings: [] };

215 const raw = JSON.parse(readFileSync(p, "utf8")) as Partial<SubmitState>;

216 if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

packages/pi-casefile/src/pipeline-submit.tsView on unpkg · L214

217 throw new Error(`Corrupt pipeline-submit state for ${runId}: root must be an object`);

218 }

219 const repairs = raw.repairs ?? {};

220 if (typeof repairs !== "object" || repairs === null || Array.isArray(repairs)) {

221 throw new Error(`Corrupt pipeline-submit state for ${runId}: repairs must be an object`);

222 }

223 for (const [k, v] of Object.entries(repairs)) {

224 if (typeof k !== "string" || typeof v !== "number" || !Number.isInteger(v) || v < 0) {

225 throw new Error(`Corrupt pipeline-submit state for ${runId}: invalid repair counter`);

226 }

227 }

228 const accepted = raw.accepted_findings ?? [];

229 if (!Array.isArray(accepted)) {

230 throw new Error(

231 `Corrupt pipeline-submit state for ${runId}: accepted_findings must be an array`,

232 );

233 }

234 for (const [i, item] of accepted.entries()) {

install.shView file

•path = install.sh kind = build_helper sizeBytes = 2876 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

packages/pi-webxp/src/websearch.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @xaccefy/pi-xpi@0.8.3 matchedIdentity = npm:QHhhY2NlZnkvcGkteHBp:0.8.3 similarity = 0.438 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/pi-webxp/src/websearch.tsView on unpkg

Source & flagged code

3 flagged · loading source

packages/pi-casefile/src/pipeline-submit.tsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code