registry / autodev-ai / 0.4.2

autodev-ai@0.4.2

AutoDev — Autonomous Engineering Team. DevTeam in a Box. Runs on pi.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed automatic npm-install attack surface. The explicit `autodev` CLI can run setup/update routines, including an optional Homebrew bootstrap and Pi-agent uninstall command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User invokes an `autodev` setup, doctor, update, or uninstall-related CLI flow.

Impact

A user who elects these flows can authorize package-manager changes, package updates, and Pi-agent configuration or uninstall actions; no unconsented lifecycle trigger was confirmed.

Mechanism

Explicit CLI execution of fixed system package-manager and Pi-agent maintenance commands.

Rationale

Read-only inspection resolves the prior manual review: `autodev-ai@0.4.2` is an AI-platform/Pi extension with broad, security-sensitive but explicitly invoked administrative capabilities. There is no npm installation lifecycle hook and no confirmed automatic foreign/broad AI-agent control-surface mutation, attacker-controlled remote payload execution, exfiltration, persistence, or destructive chain. The fixed Homebrew installer execution and CLI maintenance actions retain meaningful dual-use risk, so warn-only platform extension lifecycle handling is appropriate.

Evidence

package.jsonscripts/cli.tsextensions/autodev/installer/tools.tsextensions/autodev/installer/uninstall-module.tsinstall.shextensions/autodev/

Network endpoints1

raw.githubusercontent.com/Homebrew/install/HEAD/install.sh

Decision evidence

public snapshot

AI called this Suspicious at 80.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`extensions/autodev/installer/tools.ts` defines `installPackageManager`, which fetches and executes Homebrew's remote installer from `https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh` through `curl` and `bash`; this capability is risky but is a named, user-facing developer-tool bootstrap flow.
`extensions/autodev/installer/uninstall-module.ts` statically references shell-profile candidates and invokes `npx @earendil-works/pi-coding-agent uninstall` during the package's explicit uninstall workflow.
`scripts/cli.ts` statically loads `~/.pi/agent/.env` and exposes explicit configuration/update commands that execute system commands.

Evidence against

`package.json` has no `preinstall`, `install`, or `postinstall` lifecycle script, so installation from npm does not automatically trigger the observed command execution or configuration behavior.
The package declares a `pi.extensions` manifest and ships its main implementation in `extensions/autodev`, consistent with a first-party Pi coding-agent extension rather than an npm install hook targeting a foreign agent surface.
The only confirmed remote-code execution path is a fixed, named Homebrew bootstrap URL in `extensions/autodev/installer/tools.ts`; the inspected snippet ties it to a package-manager setup routine rather than an attacker-controlled payload source.
No inspected evidence shows remote JavaScript/command retrieval from arbitrary paste/blob storage, credential exfiltration, detached persistence, destructive action, hidden payload decoder, or an automatic write to `.mcp.json`, `CLAUDE.md`, `.claude/`, Codex/Cursor configuration, shell profiles, or OS startup locations.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 93 file(s), 670 KB of source, external domains: api.anthropic.com, api.context7.com, api.openai.com, api.voyageai.com, bun.sh, cli.github.com, deb.nodesource.com, discord.com, generativelanguage.googleapis.com, github.com, grep.app, ollama.com, raw.githubusercontent.com

Source & flagged code

10 flagged

extensions/autodev/debug/__tests__/debug.test.tsView file

Lines 226-267typescript

226 // The raw secret should NOT appear anywhere in the log

227 expect(content).not.toContain("sk-ant-abcdefghijklmnopqrstuvwxyz123456");

228

229 rmSync(dir, { recursive: true, force: true });

230});

231

232test("multiple secret patterns are redacted", async () => {

233 const dir = tmpDir();

234 const logPath = join(dir, "debug.log");

235 process.env.AUTODEV_DEBUG = "true";

236 process.env.AUTODEV_DEBUG_LOG = logPath;

237

238 const logger = getLogger();

239 logger.log({

240 timestamp: "t1",

241 level: "info",

242 event: "test",

243 data: {

244 anthropic: "sk-ant-abcdefghijklmnopqrstuvwxyz123456",

245 openrouter: "sk-or-abcdefghijklmnopqrstuvwxyz123456",

246 google: "AIzaSyDfi9nT6m1234567890ABCDEFGHIJKLMNOPQ",

High

Secret Pattern

Google API key in extensions/autodev/debug/__tests__/debug.test.ts

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L246

247 github: "ghp_abcdefghijklmnopqrstuvwxyz12345678901234",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L247

248 slack: "xoxb-abcdefghijklmnopqrstuvwxyz1234",

249 jwt: "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNqPnd9dGQm4kFy8QkZ5xGc",

250 },

251 });

252

253 await new Promise((r) => setTimeout(r, 100));

254

255 const content = await readFile(logPath, "utf-8");

256 const parsed = JSON.parse(content.trim());

257

258 expect(parsed.data.anthropic).toBe("[REDACTED]");

259 expect(parsed.data.openrouter).toBe("[REDACTED]");

260 expect(parsed.data.google).toBe("[REDACTED]");

261 expect(parsed.data.github).toBe("[REDACTED]");

262 expect(parsed.data.slack).toBe("[REDACTED]");

263 expect(parsed.data.jwt).toBe("[REDACTED]");

264

265 rmSync(dir, { recursive: true, force: true });

266});

267

247patternName = github_pat severity = critical line = 247 matchedText = github: ...34",

Critical

Secret Pattern

GitHub personal access token in extensions/autodev/debug/__tests__/debug.test.ts

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L247

extensions/autodev/background/manager.tsView file

Lines 130-170typescript

130 private maxFor(key: string): number {

131 return this.concurrencyConfig[key]?.max ?? DEFAULT_MAX_CONCURRENCY;

132 }

133

134 private running(key: string): number {

135 return this.runningPerKey.get(key) ?? 0;

extensions/autodev/docs/seeding.tsView file

Lines 174-214typescript

174 }

175

176 const destDir = join(centralCorpusRoot(), source.targetSubdir);

177 mkdirSync(destDir, { recursive: true });

178 return copyMdFiles(srcDir, destDir, source.excludePatterns, source.targetSubdir);

179 } finally {

180

extensions/autodev/installer/uninstall-module.tsView file

Lines 3-43typescript

4export interface UninstallResult {

5 readonly name: string;

6 readonly ok: boolean;

7 readonly detail: string;

extensions/autodev/embeddings.tsView file

Lines 17-57typescript

18// ---------------------------------------------------------------------------

19// Types

20// ---------------------------------------------------------------------------

22/** Injectable embedding function. Tests pass a deterministic mock. */

23export type EmbedFn = (texts: string[], isQuery?: boolean) =>

extensions/autodev/installer/tools.tsView file

Lines 1-21typescript

1import { execSync, type ExecSyncOptions } from "node:child_process";

2import { platform } from "node:os";

Critical

Download Execute

Source downloads or fetches remote code and executes it.

extensions/autodev/installer/tools.tsView on unpkg · L1

4export type Platform = "darwin" |

install.shView file

•path = install.sh kind = build_helper sizeBytes = 2692 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Source & flagged code

10 flagged · loading source

extensions/autodev/debug/__tests__/debug.test.tsView file

247patternName = github_pat severity = critical line = 247 matchedText = github: ...34",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L247

247patternName = github_pat severity = critical line = 247 matchedText = github: ...34",

Critical

Secret Pattern

GitHub personal access token in extensions/autodev/debug/__tests__/debug.test.ts

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L247

246patternName = google_api_key severity = high line = 246 matchedText = google: ...PQ",

High

Secret Pattern

Google API key in extensions/autodev/debug/__tests__/debug.test.ts

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L246

extensions/autodev/background/manager.tsView file

150L151: spawn(config: SpawnConfig): string { L152: const id = this.nextId();

High

Child Process

Package source references child process execution.

extensions/autodev/background/manager.tsView on unpkg · L150

extensions/autodev/docs/seeding.tsView file

194const mdUrls: string[] = []; L195: let match: RegExpExecArray | null; L196: while ((match = linkRegex.exec(indexText)) !== null) {

High

Shell

Package source references shell execution.

extensions/autodev/docs/seeding.tsView on unpkg · L194

extensions/autodev/installer/uninstall-module.tsView file

181try { L182: const { execSync } = await import("node:child_process"); L183: const cmd = `npx @earendil-works/pi-coding-agent uninstall ${source}`; L184: execSync(cmd, { stdio: "pipe", timeout: 60_000, cwd: process.cwd() });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

extensions/autodev/installer/uninstall-module.tsView on unpkg · L181

23const SHELL_RC_CANDIDATES = [ L24: ".bashrc", L25: ".zshrc", ... L55: const { notify } = deps; L56: const home = process.env.HOME ?? "~"; L57: const targets = [ ... L181: try { L182: const { execSync } = await import("node:child_process"); L183: const cmd = `npx @earendil-works/pi-coding-agent uninstall ${source}`; L184: execSync(cmd, { stdio: "pipe", timeout: 60_000, cwd: process.cwd() }); L185: notify(`Uninstalled ${source}`, "info");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

extensions/autodev/installer/uninstall-module.tsView on unpkg · L23

extensions/autodev/embeddings.tsView file

37): Promise<Float32Array[]> { L38: const apiKey = process.env.VOYAGE_API_KEY; L39: if (!apiKey) throw new Error("VOYAGE_API_KEY not set"); ... L42: const batch = texts.slice(i, i + VOYAGE_BATCH_SIZE); L43: const res = await fetch("https://api.voyageai.com/v1/embeddings", { L44: method: "POST", ... L48: }, L49: body: JSON.stringify({ L50: model: "voyage-3", ... L55: if (!res.ok) { L56: throw new Error(`VoyageAI embeddings failed: ${res.status} ${await res.text()}`); L57: }

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

extensions/autodev/embeddings.tsView on unpkg · L37

extensions/autodev/installer/tools.tsView file

1import { execSync, type ExecSyncOptions } from "node:child_process"; L2: import { platform } from "node:os"; ... L59: function isNonInteractive(): boolean { L60: if (process.env.CI === "true" || process.env.CI === "1") return true; L61: if (process.stdout != null && process.stdout.isTTY === false) return true; L62: if (process.argv.includes("--yes") || process.argv.includes("-y")) return true; ... L65: L66: const HOMEBREW_BOOTSTRAP_URL = "https://raw.githubusercontent.[redacted].sh"; L67: ... L108: notify(`Installing Homebrew from ${HOMEBREW_BOOTSTRAP_URL}...`, "info"); L109: exec(`bash -c 'NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL ${HOMEBREW_BOOTSTRAP_URL})"`, { L110: stdio: "inherit",

Critical

Download Execute

Source downloads or fetches remote code and executes it.

extensions/autodev/installer/tools.tsView on unpkg · L1

install.shView file

•path = install.sh kind = build_helper sizeBytes = 2692 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Findings

3 Critical5 High5 Medium4 Low

CriticalCritical Secretextensions/autodev/debug/__tests__/debug.test.ts

CriticalDownload Executeextensions/autodev/installer/tools.ts

CriticalSecret Patternextensions/autodev/debug/__tests__/debug.test.ts

HighChild Processextensions/autodev/background/manager.ts

HighShellextensions/autodev/docs/seeding.ts

HighCredential Exfiltrationextensions/autodev/embeddings.ts

HighRuntime Package Installextensions/autodev/installer/uninstall-module.ts

HighSecret Patternextensions/autodev/debug/__tests__/debug.test.ts

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistenceextensions/autodev/installer/uninstall-module.ts

MediumShips Build Helperinstall.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

10 flagged

extensions/autodev/debug/__tests__/debug.test.tsView file

Lines 226-267typescript

226 // The raw secret should NOT appear anywhere in the log

227 expect(content).not.toContain("sk-ant-abcdefghijklmnopqrstuvwxyz123456");

228

229 rmSync(dir, { recursive: true, force: true });

230});

231

232test("multiple secret patterns are redacted", async () => {

233 const dir = tmpDir();

234 const logPath = join(dir, "debug.log");

235 process.env.AUTODEV_DEBUG = "true";

236 process.env.AUTODEV_DEBUG_LOG = logPath;

237

238 const logger = getLogger();

239 logger.log({

240 timestamp: "t1",

241 level: "info",

242 event: "test",

243 data: {

244 anthropic: "sk-ant-abcdefghijklmnopqrstuvwxyz123456",

245 openrouter: "sk-or-abcdefghijklmnopqrstuvwxyz123456",

246 google: "AIzaSyDfi9nT6m1234567890ABCDEFGHIJKLMNOPQ",

High

Secret Pattern

Google API key in extensions/autodev/debug/__tests__/debug.test.ts

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L246

247 github: "ghp_abcdefghijklmnopqrstuvwxyz12345678901234",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L247

248 slack: "xoxb-abcdefghijklmnopqrstuvwxyz1234",

249 jwt: "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNqPnd9dGQm4kFy8QkZ5xGc",

250 },

251 });

252

253 await new Promise((r) => setTimeout(r, 100));

254

255 const content = await readFile(logPath, "utf-8");

256 const parsed = JSON.parse(content.trim());

257

258 expect(parsed.data.anthropic).toBe("[REDACTED]");

259 expect(parsed.data.openrouter).toBe("[REDACTED]");

260 expect(parsed.data.google).toBe("[REDACTED]");

261 expect(parsed.data.github).toBe("[REDACTED]");

262 expect(parsed.data.slack).toBe("[REDACTED]");

263 expect(parsed.data.jwt).toBe("[REDACTED]");

264

265 rmSync(dir, { recursive: true, force: true });

266});

267

247patternName = github_pat severity = critical line = 247 matchedText = github: ...34",

Critical

Secret Pattern

GitHub personal access token in extensions/autodev/debug/__tests__/debug.test.ts

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L247

extensions/autodev/background/manager.tsView file

Lines 130-170typescript

130 private maxFor(key: string): number {

131 return this.concurrencyConfig[key]?.max ?? DEFAULT_MAX_CONCURRENCY;

132 }

133

134 private running(key: string): number {

135 return this.runningPerKey.get(key) ?? 0;

extensions/autodev/docs/seeding.tsView file

Lines 174-214typescript

174 }

175

176 const destDir = join(centralCorpusRoot(), source.targetSubdir);

177 mkdirSync(destDir, { recursive: true });

178 return copyMdFiles(srcDir, destDir, source.excludePatterns, source.targetSubdir);

179 } finally {

180

extensions/autodev/installer/uninstall-module.tsView file

Lines 3-43typescript

4export interface UninstallResult {

5 readonly name: string;

6 readonly ok: boolean;

7 readonly detail: string;

extensions/autodev/embeddings.tsView file

Lines 17-57typescript

18// ---------------------------------------------------------------------------

19// Types

20// ---------------------------------------------------------------------------

22/** Injectable embedding function. Tests pass a deterministic mock. */

23export type EmbedFn = (texts: string[], isQuery?: boolean) =>

extensions/autodev/installer/tools.tsView file

Lines 1-21typescript

1import { execSync, type ExecSyncOptions } from "node:child_process";

2import { platform } from "node:os";

Critical

Download Execute

Source downloads or fetches remote code and executes it.

extensions/autodev/installer/tools.tsView on unpkg · L1

4export type Platform = "darwin" |

install.shView file

•path = install.sh kind = build_helper sizeBytes = 2692 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg