registry / @xaccefy/pi-xpi / 0.9.4

@xaccefy/pi-xpi@0.9.4

XPI — offensive security tools for Pi Agent. Casefile tracking, web search, library docs, exploit technique search, and todo tracking.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 485 KB of source, external domains: 127.0.0.1, api.preview.is, context7.com, mcp.deepwiki.com

Source & flagged code

3 flagged

packages/pi-casefile/src/pipeline-submit.tsView file

Lines 243-283typescript

243 key: string;

244 file: string;

245 line?: number;

246 endpoint?: string;

247 vuln_class: string;

248};

249

250type SubmitState = {

251 repairs: Record<string, number>;

252 accepted_findings: FindingRef[];

253};

254

255function statePath(runId: string): string {

256 return join(getRunDir(runId), "pipeline-submit.json");

257}

258

259function readState(runId: string): SubmitState {

260 const p = statePath(runId);

261 if (!existsSync(p)) return { repairs: {}, accepted_findings: [] };

262 assertSafeStateDirectory(projectRoot(), [".scratchpad", basename(dirname(p))]);

263 assertSafeRegularFile(p, "Pipeline state");

264 const raw = JSON.parse(

265 readSafeFile(p, "Pipeline state").toString("utf8"),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

packages/pi-casefile/src/pipeline-submit.tsView on unpkg · L263

266 ) as Partial<SubmitState>;

267 if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {

268 throw new Error(`Corrupt pipeline-submit state for ${runId}: root must be an object`);

269 }

270 const repairs = raw.repairs ?? {};

271 if (typeof repairs !== "object" || repairs === null || Array.isArray(repairs)) {

272 throw new Error(`Corrupt pipeline-submit state for ${runId}: repairs must be an object`);

273 }

274 for (const [k, v] of Object.entries(repairs)) {

275 if (typeof k !== "string" || typeof v !== "number" || !Number.isInteger(v) || v < 0) {

276 throw new Error(`Corrupt pipeline-submit state for ${runId}: invalid repair counter`);

277 }

278 }

279 const accepted = raw.accepted_findings ?? [];

280 if (!Array.isArray(accepted)) {

281 throw new Error(

282 `Corrupt pipeline-submit state for ${runId}: accepted_findings must be an array`,

283 );

install.shView file

•path = install.sh kind = build_helper sizeBytes = 5962 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

packages/pi-casefile/src/harness-verify.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @xaccefy/pi-xpi@0.9.2 matchedIdentity = npm:QHhhY2NlZnkvcGkteHBp:0.9.2 similarity = 0.762 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/pi-casefile/src/harness-verify.tsView on unpkg

Source & flagged code

3 flagged · loading source

packages/pi-casefile/src/pipeline-submit.tsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code