@xzy-ai/pi-c2@0.0.4: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@xzy-ai/pi-c2@0.0.4: AI-agent control-surface risk | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

26321*/ L26322: fork(...middleware) { L26323: const composer = new _Composer(...middleware);

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L26321

2570function hasPreloadFlags() { L2571: const execArgv = process.execArgv; L2572: for (let i = 0; i < execArgv.length; i++) {

High

Shell

Package source references shell execution.

index.jsView on unpkg · L2570

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. index.js: return new URL3(this._documentBaseURL).resolve(href); _documentBaseURL: { get: function() { var fs$writeFile = fs2.writeFile; fs2.writeFile = writeFile4; function writeFile4(path, data, options, cb) { return go$writeFile(path, data, options, cb); function go$writeFile(path2, data2, options2, cb2, startTime) { return fs$writeFile(path2, data2, options2, function(err) {

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

index.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. index.js: // node_modules/.pnpm/pino-std-serializers@7.1.0/node_modules/pino-std-serializers/lib/err-helpers.js "node_modules/.pnpm/pino-std-serializers@7.1.0/node_modules/pino-std-serializers/lib/err-helpers.js"(exports, module) { // node_modules/.pnpm/pino-std-serializers@7.1.0/node_modules/pino-std-serializers/lib/err-proto.js "node_modules/.pnpm/pino-std-serializers@7.1.0/node_modules/pino-std-serializers/lib/err-proto.js"(exports, module) { // node_modules/.pnpm/pino-std-serializers@7.1.0/node_modules/pino-std-serializers/lib/err.js "node_modules/.pnpm/pino-std-serializers@7.1.0/node_modules/pino-std-serializers/lib/err.js"(exports, module) { // node_

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

index.jsView on unpkg

1101for (var i = 0; i < flen; ) { L1102: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L1103: lastPos = lastPos > -1 ? lastPos : 0; ... L1336: fsWriteSync = () => fs.writeSync(this.fd, this._writingBuf); L1337: fsWrite = () => fs.write(this.fd, this._writingBuf, this.release); L1338: } else if (contentMode === void 0 || contentMode === kContentModeUtf8) { ... L1901: L1902: // node_modules/.pnpm/thread-stream@4.2.0/node_modules/thread-stream/package.json L1903: var require_package = __commonJS({ ... L1939: type: "git", L1940: url: "git+https://github.com/mcollina/thread-stream.git" L1941: },

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L1101

Source & flagged code

7 flagged

package.jsonView file

Lines 1-33json

1{

2 "name": "@xzy-ai/pi-c2",

3 "version": "0.0.4",

4 "description": "PI extension: delegate work to isolated in-process subagents through model-callable tools",

5 "type": "module",

6 "main": "./index.js",

7 "files": [

8 "index.js",

9 "scripts/"

10 ],

11 "private": false,

12 "scripts": {

13 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "typecheck": "tsgo --noEmit",

15 "test": "node --test --test-force-exit --import ../../test-setup.mjs --import tsx tests/extension.test.ts tests/manager-removal.test.ts tests/postinstall.test.ts"

16 },

17 "dependencies": {

18 "@earendil-works/pi-coding-agent": "^0.84.2",

19 "@earendil-works/pi-tui": "^0.84.2",

20 "diff": "^9.0.0"

21 },

22 "devDependencies": {

23 "@xzy-ai/commands": "workspace:*",

24 "@xzy-ai/core": "workspace:*",

25 "@xzy-ai/mcp": "workspace:*",

26 "@xzy-ai/runtime": "workspace:*",

27 "@xzy-ai/tools": "workspace:*"

28 },

29 "publishConfig": {

30 "access": "public"

31 }

32}

33

index.jsView file

26321*/ L26322: fork(...middleware) { L26323: const composer = new _Composer(...middleware);

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L26321

2570function hasPreloadFlags() { L2571: const execArgv = process.execArgv; L2572: for (let i = 0; i < execArgv.length; i++) {

High

Shell

Package source references shell execution.

index.jsView on unpkg · L2570

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. index.js: return new URL3(this._documentBaseURL).resolve(href); _documentBaseURL: { get: function() { var fs$writeFile = fs2.writeFile; fs2.writeFile = writeFile4; function writeFile4(path, data, options, cb) { return go$writeFile(path, data, options, cb); function go$writeFile(path2, data2, options2, cb2, startTime) { return fs$writeFile(path2, data2, options2, function(err) {

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

index.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. index.js: // node_modules/.pnpm/pino-std-serializers@7.1.0/node_modules/pino-std-serializers/lib/err-helpers.js "node_modules/.pnpm/pino-std-serializers@7.1.0/node_modules/pino-std-serializers/lib/err-helpers.js"(exports, module) { // node_modules/.pnpm/pino-std-serializers@7.1.0/node_modules/pino-std-serializers/lib/err-proto.js "node_modules/.pnpm/pino-std-serializers@7.1.0/node_modules/pino-std-serializers/lib/err-proto.js"(exports, module) { // node_modules/.pnpm/pino-std-serializers@7.1.0/node_modules/pino-std-serializers/lib/err.js "node_modules/.pnpm/pino-std-serializers@7.1.0/node_modules/pino-std-serializers/lib/err.js"(exports, module) { // node_