@zhuxixi/pi-agent-board: Manual Review npm security report | LPM Firewall

Loading npm security reports…

@zhuxixi/pi-agent-board: Manual Review npm security report | LPM Firewall

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/patch-vulns.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

runner/state-runner.mjsView file

8*/ L9: import { spawn } from "node:child_process"; L10: import { readJson } from "../src/core/atomic.mjs";

High

Child Process

Package source references child process execution.

runner/state-runner.mjsView on unpkg · L8

src/core/auto-state.mjsView file

25/** @param {NodeJS.ProcessEnv|Record<string,string|undefined>} [env] */ L26: export function autoStateEnabled(env = process.env) { L27: const raw = env.AGENT_BOARD_AUTO_STATE ?? env.AGENT_VIEW_AUTO_STATE; ... L300: try { L301: const parsed = JSON.parse(candidate); L302: if (parsed && typeof parsed === "object") return parsed;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/core/auto-state.mjsView on unpkg · L25

scripts/patch-vulns.mjsView file

46try { L47: execSync(`npm install ${name}@${version} --prefix "${tmp}" --ignore-scripts`, { L48: stdio: "pipe",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/patch-vulns.mjsView on unpkg · L46

scripts/release.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/release.mjs#virtual:normalized:round1View on unpkg

src/core/pty-support.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @zhuxixi/pi-agent-board@0.7.0 matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.7.0 similarity = 0.559 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/core/pty-support.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @zhuxixi/pi-agent-board@0.6.2 matchedPath = src/core/pty-support.mjs matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/pty-support.mjsView on unpkg

scripts/release_helper.mjsView file

•matchType = normalized_sha256 matchedPackage = @zhuxixi/pi-agent-board@0.6.2 matchedPath = scripts/release_helper.mjs matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release_helper.mjsView on unpkg

runner/title-runner.mjsView file

•matchType = normalized_sha256 matchedPackage = @zhuxixi/pi-agent-board@0.6.2 matchedPath = runner/title-runner.mjs matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runner/title-runner.mjsView on unpkg

src/core/code-refs.mjsView file

•matchType = normalized_sha256 matchedPackage = @zhuxixi/pi-agent-board@0.6.2 matchedPath = src/core/code-refs.mjs matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/code-refs.mjsView on unpkg

src/core/pty-scroll.mjsView file

•matchType = normalized_sha256 matchedPackage = @zhuxixi/pi-agent-board@0.6.2 matchedPath = src/core/pty-scroll.mjs matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/pty-scroll.mjsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 34-74json

34 "url": "git+https://github.com/zhuxixi/pi-agent-board.git"

35 },

36 "bugs": {

37 "url": "https://github.com/zhuxixi/pi-agent-board/issues"

38 },

39 "homepage": "https://github.com/zhuxixi/pi-agent-board#readme",

40 "publishConfig": {

41 "access": "public"

42 },

43 "engines": {

44 "node": ">=20"

45 },

46 "pi": {

47 "extensions": [

48 "./src/index.ts"

49 ],

50 "video": "https://github.com/zhuxixi/pi-agent-board/raw/refs/heads/main/assets/demo.mp4",

51 "image": "https://github.com/zhuxixi/pi-agent-board/raw/refs/heads/main/assets/banner.png"

52 },

53 "scripts": {

54 "postinstall": "node scripts/patch-vulns.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

55 "typecheck": "tsc --noEmit",

56 "test": "node --test test/*.test.mjs",

57 "test:coverage": "c8 node --test test/*.test.mjs",

58 "test:perf": "node scripts/run-perf-gate.mjs",

59 "pack:dry": "npm pack --dry-run",

60 "verify": "npm run typecheck && npm run test:perf && npm test && npm run test:coverage && npm run pack:dry",

61 "changelog": "node scripts/release_helper.mjs"

62 },

63 "peerDependencies": {

64 "@earendil-works/pi-coding-agent": "*",

65 "@earendil-works/pi-tui": "*"

66 },

67 "peerDependenciesMeta": {

68 "@earendil-works/pi-coding-agent": {

69 "optional": true

70 },

71 "@earendil-works/pi-tui": {

72 "optional": true

73 }

74 },

runner/state-runner.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * Detached auto-state classifier.

4 *

5 * Reads the latest assistant turn from evidence/state, asks a cheap model to classify

6 * the terminal bucket, and updates state.json (and status.json when a run id exists).

7 * Safe best-effort: on model failure it falls back to the same heuristic classifier.

8 */

9import { spawn } from "node:child_process"

src/core/auto-state.mjsView file

Lines 5-45javascript

5 * - needs_input → agent is waiting on the user

6 * - idle → in progress / worth revisiting

7 * - completed → done

8 *

9 *

scripts/patch-vulns.mjsView file

Lines 26-60javascript

26 { name: "brace-expansion", version: "5.0.8" },

27 { name: "protobufjs", version: "7.6.5" },

28];

29

30for (const {

scripts/release.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/release.mjs#virtual:normalized:round1View on unpkg

src/core/pty-support.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @zhuxixi/pi-agent-board@0.7.0 matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.7.0 similarity = 0.559 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/core/pty-support.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @zhuxixi/pi-agent-board@0.6.2 matchedPath = src/core/pty-support.mjs matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/pty-support.mjsView on unpkg

scripts/release_helper.mjsView file

•matchType = normalized_sha256 matchedPackage = @zhuxixi/pi-agent-board@0.6.2 matchedPath = scripts/release_helper.mjs matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release_helper.mjsView on unpkg

runner/title-runner.mjsView file

•matchType = normalized_sha256 matchedPackage = @zhuxixi/pi-agent-board@0.6.2 matchedPath = runner/title-runner.mjs matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runner/title-runner.mjsView on unpkg

src/core/code-refs.mjsView file

•matchType = normalized_sha256 matchedPackage = @zhuxixi/pi-agent-board@0.6.2 matchedPath = src/core/code-refs.mjs matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/code-refs.mjsView on unpkg

src/core/pty-scroll.mjsView file

•matchType = normalized_sha256 matchedPackage = @zhuxixi/pi-agent-board@0.6.2 matchedPath = src/core/pty-scroll.mjs matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/pty-scroll.mjsView on unpkg