@zhuxixi/pi-agent-board@0.5.0: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@zhuxixi/pi-agent-board@0.5.0: Suspicious npm security report | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/patch-vulns.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

runner/state-runner.mjsView file

8*/ L9: import { spawn } from "node:child_process"; L10: import { readJson } from "../src/core/atomic.mjs";

High

Child Process

Package source references child process execution.

runner/state-runner.mjsView on unpkg · L8

src/core/auto-state.mjsView file

•matchType = normalized_sha256 matchedPackage = @zhuxixi/pi-agent-board@0.6.2 matchedPath = src/core/auto-state.mjs matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/auto-state.mjsView on unpkg

25/** @param {NodeJS.ProcessEnv|Record<string,string|undefined>} [env] */ L26: export function autoStateEnabled(env = process.env) { L27: const raw = env.AGENT_BOARD_AUTO_STATE ?? env.AGENT_VIEW_AUTO_STATE; ... L298: try { L299: const parsed = JSON.parse(candidate); L300: if (parsed && typeof parsed === "object") return parsed;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/core/auto-state.mjsView on unpkg · L25

scripts/patch-vulns.mjsView file

46try { L47: execSync(`npm install ${name}@${version} --prefix "${tmp}" --ignore-scripts`, { L48: stdio: "pipe",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/patch-vulns.mjsView on unpkg · L46

src/ui/pty-attach.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/ui/pty-attach.ts#virtual:normalized:round1View on unpkg

src/core/pty-support.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @zhuxixi/pi-agent-board@0.7.0 matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.7.0 similarity = 0.491 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/core/pty-support.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @zhuxixi/pi-agent-board@0.6.2 matchedPath = src/core/pty-support.mjs matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/pty-support.mjsView on unpkg

src/core/pty-scroll.mjsView file

•matchType = normalized_sha256 matchedPackage = @zhuxixi/pi-agent-board@0.6.2 matchedPath = src/core/pty-scroll.mjs matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/pty-scroll.mjsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 33-73json

33 "url": "git+https://github.com/zhuxixi/pi-agent-board.git"

34 },

35 "bugs": {

36 "url": "https://github.com/zhuxixi/pi-agent-board/issues"

37 },

38 "homepage": "https://github.com/zhuxixi/pi-agent-board#readme",

39 "publishConfig": {

40 "access": "public"

41 },

42 "engines": {

43 "node": ">=20"

44 },

45 "pi": {

46 "extensions": [

47 "./src/index.ts"

48 ],

49 "video": "https://github.com/zhuxixi/pi-agent-board/raw/refs/heads/main/assets/demo.mp4",

50 "image": "https://github.com/zhuxixi/pi-agent-board/raw/refs/heads/main/assets/banner.png"

51 },

52 "scripts": {

53 "postinstall": "node scripts/patch-vulns.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

54 "typecheck": "tsc --noEmit",

55 "test": "node --test test/*.test.mjs",

56 "test:coverage": "c8 node --test test/*.test.mjs",

57 "pack:dry": "npm pack --dry-run",

58 "verify": "npm run typecheck && npm test && npm run test:coverage && npm run pack:dry"

59 },

60 "peerDependencies": {

61 "@earendil-works/pi-coding-agent": "*",

62 "@earendil-works/pi-tui": "*"

63 },

64 "peerDependenciesMeta": {

65 "@earendil-works/pi-coding-agent": {

66 "optional": true

67 },

68 "@earendil-works/pi-tui": {

69 "optional": true

70 }

71 },

72 "devDependencies": {

73 "@earendil-works/pi-coding-agent": "0.79.8",

runner/state-runner.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * Detached auto-state classifier.

4 *

5 * Reads the latest assistant turn from evidence/state, asks a cheap model to classify

6 * the terminal bucket, and updates state.json (and status.json when a run id exists).

7 * Safe best-effort: on model failure it falls back to the same heuristic classifier.

8 */

9import { spawn } from "node:child_process"

src/core/auto-state.mjsView file

Lines 5-45javascript

5 * - needs_input → agent is waiting on the user

6 * - idle → in progress / worth revisiting

7 * - completed → done

8 *

9 *

scripts/patch-vulns.mjsView file

Lines 26-60javascript

26 { name: "brace-expansion", version: "5.0.8" },

27 { name: "protobufjs", version: "7.6.5" },

28];

29

30for (const {

src/ui/pty-attach.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/ui/pty-attach.ts#virtual:normalized:round1View on unpkg

src/core/pty-support.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @zhuxixi/pi-agent-board@0.7.0 matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.7.0 similarity = 0.491 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/core/pty-support.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @zhuxixi/pi-agent-board@0.6.2 matchedPath = src/core/pty-support.mjs matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/pty-support.mjsView on unpkg

src/core/pty-scroll.mjsView file

•matchType = normalized_sha256 matchedPackage = @zhuxixi/pi-agent-board@0.6.2 matchedPath = src/core/pty-scroll.mjs matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/pty-scroll.mjsView on unpkg