registry / @xzy-ai/pi-c2 / 0.84.2-1.821.2026

@xzy-ai/pi-c2@0.84.2-1.821.2026

PI extension: delegate work to isolated in-process subagents through model-callable tools

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The postinstall hook performs host SDK modification without a consent prompt, creating a concrete guarded agent-extension lifecycle risk. The inspected code applies the bundled patch to the named host SDK, so the evidence does not support a malicious block.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package with lifecycle scripts enabled.

Impact

Changes host SDK behavior for this extension; the source inspected does not establish credential theft or a broader control hijack.

Mechanism

The postinstall script locates the host pi-coding-agent, backs it up, and writes patched host files.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsscripts/pi-coding-agent@0.84.2.patchindex.js

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The postinstall hook runs a script that locates the host pi-coding-agent installation.
The script applies a bundled patch and writes changed files into that host installation without a consent check.
The extension scans project agent directories and reads their configuration files.

Evidence against

The patch targets the named host SDK used by this extension; inspected behavior does not show a foreign or broad agent-control-surface mutation.
The Exa API key is used in a request to the configured Exa service, with no evidence of an unrelated credential recipient.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 3.42 MB of source, external domains: api.telegram.org, github.com, json-schema.org, mcp.exa.ai, raw.githubusercontent.com, t.me, telegram.me, www.ibm.com, www.typescriptlang.org, www.w3.org

Source & flagged code

7 flagged

package.jsonView file

Lines 1-38json

2 "name": "@xzy-ai/pi-c2",

3 "version": "0.84.2-1.821.2026",

4 "description": "PI extension: delegate work to isolated in-process subagents through model-callable tools",

5 "type": "module",

6 "main": "./index.js",

7 "files": [

8 "index.js",

9 "scripts/"

10 ],

11 "pi": {

12 "extensions": [

13 "./index.js"

14 ]

15 },

16 "private": false,

17 "scripts": {

18 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 "typecheck": "tsgo --noEmit",

20 "test": "node --test --test-force-exit --import ../../test-setup.mjs --import tsx tests/extension.test.ts tests/manager-removal.test.ts tests/postinstall.test.ts tests/percentage-compaction.test.ts tests/midturn-compaction.test.ts tests/repro-abort-loop.test.ts"

21 },

22 "dependencies": {

23 "@earendil-works/pi-coding-agent": "^0.84.2",

24 "@earendil-works/pi-tui": "^0.84.2",

25 "diff": "^9.0.0"

26 },

27 "devDependencies": {

28 "@xzy-ai/commands": "workspace:*",

29 "@xzy-ai/core": "workspace:*",

30 "@xzy-ai/mcp": "workspace:*",

31 "@xzy-ai/runtime": "workspace:*",

32 "@xzy-ai/tools": "workspace:*"

33 },

34 "publishConfig": {

35 "access": "public"

36 }

37}

index.jsView file

26321*/ L26322: fork(...middleware) { L26323: const composer = new _Composer(...middleware);

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L26321

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. index.js: return new URL3(this._documentBaseURL).resolve(href); _documentBaseURL: { get: function() { var fs$writeFile = fs2.writeFile; fs2.writeFile = writeFile4; function writeFile4(path, data, options, cb) { return go$writeFile(path, data, options, cb); function go$writeFile(path2, data2, options2, cb2, startTime) { return fs$writeFile(path2, data2, options2, function(err) {

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

index.jsView on unpkg

1101for (var i = 0; i < flen; ) { L1102: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L1103: lastPos = lastPos > -1 ? lastPos : 0; ... L1336: fsWriteSync = () => fs.writeSync(this.fd, this._writingBuf); L1337: fsWrite = () => fs.write(this.fd, this._writingBuf, this.release); L1338: } else if (contentMode === void 0 || contentMode === kContentModeUtf8) { ... L1901: L1902: // node_modules/.pnpm/thread-stream@4.2.0/node_modules/thread-stream/package.json L1903: var require_package = __commonJS({ ... L1939: type: "git", L1940: url: "git+https://github.com/mcollina/thread-stream.git" L1941: },

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

26321*/ L26322: fork(...middleware) { L26323: const composer = new _Composer(...middleware);

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L26321

Findings

5 High4 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processindex.js

HighCredential Redirect Persistenceindex.js

HighCommand Output Exfiltrationindex.js

HighKnown Malware Source Similarityindex.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalindex.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @xzy-ai/pi-c2@0.84.2-1.821.2026.

See all versions of @xzy-ai/pi-c2 for other recorded verdicts.

Review the evidence and your use of @xzy-ai/pi-c2@0.84.2-1.821.2026 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 02:32:53.289Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.