registry / @zephyrdeng/pi-review / 0.8.1

@zephyrdeng/pi-review@0.8.1

Isolated AI-powered code and plan reviews from the command line

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 81 file(s), 565 KB of source, external domains: 127.0.0.1, evil.example, pi.dev

Source & flagged code

3 flagged

dist/panel-ui.jsView file

Lines 1-29javascript

1// Launcher glue for the loopback dashboard (issue #4). Spawns the detached

2// server process, waits for its ready handshake over a temporary IPC

3// channel, then fully detaches it so it outlives the review process. The

4// returned onEvent listener is the only ongoing link between the review

5// process and the dashboard: it appends redacted ReviewEvent v1 JSONL to the

6// run directory, which the detached server tails independently.

7import fs from "node:fs";

8import path from "node:path";

9import { randomUUID } from "node:crypto";

10import { fork } from "node:child_process";

11import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/panel-ui.jsView on unpkg · L9

12import { createRunDirectory, generateCapabilityToken, writeUrlFileAtomic, DEFAULT_UI_TTL_SECONDS } from "./ui-server.js";

13function defaultServerEntry() {

14 return fileURLToPath(new URL("./ui-server-main.js", import.meta.url));

15}

16function waitForReady(child, timeoutMs) {

17 return new Promise((resolve) => {

18 const timer = setTimeout(() => resolve(undefined), timeoutMs);

19 const done = (result) => {

20 clearTimeout(timer);

21 resolve(result);

22 };

23 child.once("message", (msg) => done(msg));

24 child.once("error", () => done(undefined));

25 child.once("exit", () => done(undefined));

26 });

27}

28/** Start the dashboard; returns undefined (with a stderr warning already written) if startup fails. */

29export async function launchPanelUi(options = {}) {

dist/cli-exit.test.jsView file

Lines 1-36javascript

1import assert from "node:assert/strict";

2import fs from "node:fs";

3import os from "node:os";

4import path from "node:path";

5import { spawnSync } from "node:child_process";

dist/skill.jsView file

Lines 1-34javascript

1import fs from "node:fs";

2import os from "node:os";

3import path from "node:path";

4import { spawnSync } from "node:child_process";

5import { fileURLToPath } from "node:url";

6const

Source & flagged code

3 flagged · loading source

dist/panel-ui.jsView file

9import { randomUUID } from "node:crypto"; L10: import { fork } from "node:child_process"; L11: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/panel-ui.jsView on unpkg · L9

dist/cli-exit.test.jsView file

16// `npx tsx --test`), so we don't double-register. Under vitest the worker's L17: // execArgv has no tsx, so fall back to the project-local tsx package which L18: // Node resolves from node_modules via `--import tsx`.

High

Shell

Package source references shell execution.

dist/cli-exit.test.jsView on unpkg · L16

dist/skill.jsView file

14function hasSkillsCli() { L15: const result = spawnSync("npx", ["skills", "--version"], { L16: encoding: "utf8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/skill.jsView on unpkg · L14

Findings

3 High3 Medium5 Low

HighChild Processdist/panel-ui.js

HighShelldist/cli-exit.test.js

HighRuntime Package Installdist/skill.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/panel-ui.jsView file

Lines 1-29javascript

1// Launcher glue for the loopback dashboard (issue #4). Spawns the detached

2// server process, waits for its ready handshake over a temporary IPC

3// channel, then fully detaches it so it outlives the review process. The

4// returned onEvent listener is the only ongoing link between the review

5// process and the dashboard: it appends redacted ReviewEvent v1 JSONL to the

6// run directory, which the detached server tails independently.

7import fs from "node:fs";

8import path from "node:path";

9import { randomUUID } from "node:crypto";

10import { fork } from "node:child_process";

11import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/panel-ui.jsView on unpkg · L9

12import { createRunDirectory, generateCapabilityToken, writeUrlFileAtomic, DEFAULT_UI_TTL_SECONDS } from "./ui-server.js";

13function defaultServerEntry() {

14 return fileURLToPath(new URL("./ui-server-main.js", import.meta.url));

15}

16function waitForReady(child, timeoutMs) {

17 return new Promise((resolve) => {

18 const timer = setTimeout(() => resolve(undefined), timeoutMs);

19 const done = (result) => {

20 clearTimeout(timer);

21 resolve(result);

22 };

23 child.once("message", (msg) => done(msg));

24 child.once("error", () => done(undefined));

25 child.once("exit", () => done(undefined));

26 });

27}

28/** Start the dashboard; returns undefined (with a stderr warning already written) if startup fails. */

29export async function launchPanelUi(options = {}) {

dist/cli-exit.test.jsView file

Lines 1-36javascript

1import assert from "node:assert/strict";

2import fs from "node:fs";

3import os from "node:os";

4import path from "node:path";

5import { spawnSync } from "node:child_process";

dist/skill.jsView file

Lines 1-34javascript

1import fs from "node:fs";

2import os from "node:os";

3import path from "node:path";

4import { spawnSync } from "node:child_process";

5import { fileURLToPath } from "node:url";

6const