registry / @zhcsyncer/pi-extensions / 0.5.0

@zhcsyncer/pi-extensions@0.5.0

A collection of Pi extensions by zhcsyncer.

Static Scan Results

scanned 14h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 81 file(s), 565 KB of source, external domains: api.exa.ai, api.fastcrw.com, api.firecrawl.dev, api.langsearch.com, api.linkup.so, api.perplexity.ai, api.search.brave.com, api.tavily.com, api.websearchapi.ai, api.you.com, api2.marginalia-search.com, exa.ai, google.serper.dev, mcp.exa.ai, r.jina.ai, raw.githubusercontent.com, s.jina.ai, sofya.co

Source & flagged code

2 flagged

packages/pi-search-hub/extensions/utils.tsView file

Lines 7-47typescript

8// ---------------------------------------------------------------------------

9// Constants

10// ---------------------------------------------------------------------------

12export const HTTP_TIMEOUT_MS = 30_000;

13export const COOLDOWN_MS = 2_000;

14export const COMMAND_TIMEOUT_MS = 5_000;

16export const MISSING_KEY_HELP =

17 "Set the API key via env var (SEARCH_<BACKEND>_API_KEY), " +

18 "config reference (\"apiKey\": \"SOME_ENV_VAR\"), " +

19 "shell command (\"apiKey\": \"!pass show api/backend\"), " +

20 "or a literal key in ~/.pi/agent/extensions/search.json. " +

21 "DuckDuckGo needs no key. Marginalia uses a shared public key (optional)."

23// ---------------------------------------------------------------------------

24// Agent directory

25// ---------------------------------------------------------------------------

27export function getAgentDir(): string {

28 return join(process.env.HOME || process.env.USERPROFILE || "~", ".pi", "agent");

29}

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

packages/pi-search-hub/extensions/utils.tsView on unpkg · L27

31// ---------------------------------------------------------------------------

32// Per-backend cooldown

33// ---------------------------------------------------------------------------

35const backendCooldowns = new Map<string, number>();

37export function waitForCooldown(backend: string): Promise<void> {

38 const until = backendCooldowns.get(backend);

39 if (!until) return Promise.resolve();

40 const delay = until - Date.now();

41 if (delay <= 0) return Promise.resolve();

42 return new Promise(r => setTimeout(r, delay));

43}

45export function markCooldown(backend: string) {

46 backendCooldowns.set(backend, Date.now() + COOLDOWN_MS);

47}

packages/pi-search-hub/extensions/credentials.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @zhcsyncer/pi-extensions@0.3.0 matchedIdentity = npm:[redacted]:0.3.0 similarity = 0.898 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/pi-search-hub/extensions/credentials.tsView on unpkg

Source & flagged code

2 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code