registry / pando-ai

pando-ai

pandō gives coding agents a versioned code database, durable node and symbol identities, coordinated MCP operations, and rendered workspaces for builds and tests.

This report shows the evidence for pando-ai@1.3.0. 0 of 4 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The manifest has no install hooks, and the CLI uses product authentication plus model-provider endpoints. The apparent credential flow uses an Authorization header for model requests, while the inspected gateway configuration restricts provider origins to official endpoints; the scanner's eval and subprocess flags alone do not establish malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicitly running the pando-ai CLI or invoking its coding-agent features.

Impact

No malicious impact identified in the inspected source.

Mechanism

The CLI uses its configured authentication service and sends model requests to supported provider endpoints; the inspected source does not show credential redirection or execution of remote responses as code.

AI rationale

Evidence

~/.pando-ai/session.json

Network endpoints7

getpando.ai/api/auth/poll/initgetpando.ai/api/auth/poll/statusgetpando.ai/api/auth/cli/exchangeehurtggpaunbndlxuemq.supabase.coapi.openai.com/v1chatgpt.com/backend-api/codexapi.anthropic.com

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest defines no install lifecycle hooks and exposes the CLI through bin/pando-ai.js.
The CLI entrypoint loads dist/cli.js after checking the Node version.
The gateway defaults to official OpenAI, ChatGPT Codex, and Anthropic upstreams and rejects other OpenAI or Anthropic origins.
OPENAI_API_KEY is used to form an Authorization bearer header for model requests.
The package has a product-specific authentication service at getpando.ai and a configured Supabase project.

Evidence against

The bundled CLI contains eval and child_process references, but the inspected eval occurrence is in compiler glue and the package provides coding-agent tooling that uses subprocesses.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Source & flagged code

17 flagged

dist/native/ts7/darwin-arm64/api-sync.mjsView file

14523spawn L14524: } from "node:child_process"; L14525: import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/native/ts7/darwin-arm64/api-sync.mjsView on unpkg · L14523

dist/workers/chunk-X543BOTA.mjsView file

4${f}`)}}));let n=await o.loadWebAssemblyModule(await r,{loadAsync:!0}),s=Object.keys(n),a=s.find(c=>ln.test(c)&&!c.includes("external_scanner_"));if(!a)throw console.log(`Couldn't ... L5: ${JSON.stringify(s,null,2)}`),new Error("Language.load failed: no language function found in WASM file");let l=n[a]();return new Kt(se,l)}},cn=(()=>{var _scriptName=import.meta.url... L6: `)}catch{}}var jn=Number(process.env.PANDO_PYTHON_WORKER_PARSE_TIMEOUT_MS||18e4),qn=Number(process.env.PANDO_PYTHON_WORKER_RESOLVE_TIMEOUT_MS||18e4),be=class extends Error{construc...

High

Eval

Package source references dynamic code evaluation.

dist/workers/chunk-X543BOTA.mjsView on unpkg · L4

Findings

4 Critical9 High6 Medium6 Low

CriticalSame File Env Network Executiondist/cli.js

CriticalCredential Exfiltrationdist/cli.js

CriticalRemote Response Code Executiondist/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli.js

HighChild Processdist/native/ts7/darwin-arm64/api-sync.mjs

HighEvaldist/workers/chunk-X543BOTA.mjs

HighCredential Redirect Persistencedist/cli.js

HighCommand Output Exfiltrationdist/workers/chunk-X543BOTA.mjs

HighObfuscated Payload Loaderdist/cli.js

HighTrigger Reachable Credential Exfiltrationdist/cli.js

HighTrigger Reachable Command Output Exfiltrationdist/cli.js

Affected versions and remediation

This report applies to pando-ai@1.3.0.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of pando-ai@1.3.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-30 00:08:05.192Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions

1.3.0latestshownClean—AllowPublishedOct 30, 2026, 12:04 AM 1.2.6SuspiciousTelemetryWarnPublishedOct 29, 2026, 11:39 PM 1.2.4SuspiciousAgent extension lifecycle riskWarnPublishedSep 28, 2026, 3:25 AM 1.2.3Suspicious—WarnUnder ReviewJul 9, 2026, 12:32 AM

registry / pando-ai

pando-ai

pandō gives coding agents a versioned code database, durable node and symbol identities, coordinated MCP operations, and rendered workspaces for builds and tests.

This report shows the evidence for pando-ai@1.3.0. 0 of 4 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicitly running the pando-ai CLI or invoking its coding-agent features.

Impact

No malicious impact identified in the inspected source.

Mechanism

AI rationale

Evidence

~/.pando-ai/session.json

Network endpoints7

getpando.ai/api/auth/poll/initgetpando.ai/api/auth/poll/statusgetpando.ai/api/auth/cli/exchangeehurtggpaunbndlxuemq.supabase.coapi.openai.com/v1chatgpt.com/backend-api/codexapi.anthropic.com

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest defines no install lifecycle hooks and exposes the CLI through bin/pando-ai.js.
The CLI entrypoint loads dist/cli.js after checking the Node version.
The gateway defaults to official OpenAI, ChatGPT Codex, and Anthropic upstreams and rejects other OpenAI or Anthropic origins.
OPENAI_API_KEY is used to form an Authorization bearer header for model requests.
The package has a product-specific authentication service at getpando.ai and a configured Supabase project.

Evidence against

The bundled CLI contains eval and child_process references, but the inspected eval occurrence is in compiler glue and the package provides coding-agent tooling that uses subprocesses.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Source & flagged code

17 flagged

dist/native/ts7/darwin-arm64/api-sync.mjsView file

14523spawn L14524: } from "node:child_process"; L14525: import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/native/ts7/darwin-arm64/api-sync.mjsView on unpkg · L14523

dist/workers/chunk-X543BOTA.mjsView file

High

Eval

Package source references dynamic code evaluation.

dist/workers/chunk-X543BOTA.mjsView on unpkg · L4

Findings

4 Critical9 High6 Medium6 Low

CriticalSame File Env Network Executiondist/cli.js

CriticalCredential Exfiltrationdist/cli.js

CriticalRemote Response Code Executiondist/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli.js

HighChild Processdist/native/ts7/darwin-arm64/api-sync.mjs

HighEvaldist/workers/chunk-X543BOTA.mjs

HighCredential Redirect Persistencedist/cli.js

HighCommand Output Exfiltrationdist/workers/chunk-X543BOTA.mjs

HighObfuscated Payload Loaderdist/cli.js

HighTrigger Reachable Credential Exfiltrationdist/cli.js

HighTrigger Reachable Command Output Exfiltrationdist/cli.js

Affected versions and remediation

This report applies to pando-ai@1.3.0.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of pando-ai@1.3.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-30 00:08:05.192Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions