registry / pi-all-notification / 1.0.0

pi-all-notification@1.0.0

Multi-channel notification for pi: macOS desktop, Bark push, custom webhook

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious behavior, but the extension has agent lifecycle hooks and a shell-command injection risk in macOS notifications. It writes only its own pi extension config and sends notification payloads to configured services.

Static reason

One or more suspicious static signals were detected.

Trigger

Pi extension runtime events or notify_user tool invocation after the extension is installed/enabled

Impact

Possible local command execution if attacker-controlled notification text containing shell metacharacters reaches macOS notification path; configured notification endpoints receive titles/messages.

Mechanism

platform notification extension with osascript shell execution and optional fetch notifications

Attack narrative

The package is a pi notification extension. On session_start it initializes its own config under ~/.pi/agent/extensions/pi-all-notification, registers a notification tool and settings command, and on agent events can show macOS notifications or send Bark/webhook requests. The macOS path uses execSync with a shell command containing notification title/body, and user prompt text can become the agent_end notification message, creating a plausible command injection vulnerability on macOS. This appears to be a vulnerable package-aligned feature, not deliberate malware.

Rationale

Static source inspection supports a package-aligned pi notification extension, but the unescaped shell interpolation in the default-enabled macOS notification path is a real security risk. Because there is no install-time hijack, exfiltration, persistence, or foreign agent control-surface mutation, warn rather than block.

Evidence

package.jsonextensions/index.tsREADME.mdconfig.json~/.pi/agent/extensions/pi-all-notification/config.json

Network endpoints2

api.day.appuser-configured webhook URL

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Critical Vulnerability with medium false-positive risk.

Evidence for warning

extensions/index.ts registers a pi platform extension tool/command and event hooks.
extensions/index.ts session_start creates/updates ~/.pi/agent/extensions/pi-all-notification/config.json.
extensions/index.ts notifyMacOS builds an osascript shell command with interpolated title/body and only escapes double quotes; agent_end uses user message text by default.
extensions/index.ts can send notifications to default Bark host or user-configured webhook URLs when enabled.

Evidence against

package.json has no npm lifecycle scripts, bin, main, or dependency install hooks.
package.json pi.extensions points only to ./extensions/index.ts, a platform extension entrypoint.
Network sends notification title/message to configured notification services; Bark and webhook are disabled unless configured with key/url.
No credential harvesting, broad filesystem scanning, persistence, remote code loading, or foreign AI-agent control surface writes found.

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 30.8 KB of source, external domains: api.day.app

Source & flagged code

1 flagged

extensions/index.tsView file

Lines 456-496typescript

456 if (choice === undefined) break;

457

458 if (items[choice].value === "back") break;

459 if (items[choice].value === "toggle") {

460 b.enabled = !b.enabled;

461 saveConfig(cfg);

462 }

463 if (items[choice].value === "key") {

464 const k = await ctx.ui.input("Bark device key:", b.key || "");

465 if (k !== undefined && k.trim()) { b.key = k.trim(); saveConfig(cfg); ctx.ui.notify("Bark key saved", "info"); }

466 }

467 if (items[choice].value === "server") {

468 const s = await ctx.ui.input("Bark server URL:", b.server);

469 if (s !== undefined && s.trim()) { b.server = s.trim(); saveConfig(cfg); ctx.ui.notify("Bark server saved", "info"); }

470 }

471 if (items[choice].value === "auth") {

472 const u = await ctx.ui.input("Auth username (leave empty to clear):", b.authUser || "");

473 if (u === undefined) continue;

474 if (!u.trim()) { delete b.authUser; delete b.authPass; saveConfig(cfg); ctx.ui.notify("Auth cleared", "info"); continue; }

475 b.authUser = u.trim();

476 const p = await ctx.ui.input("Auth password:", b.authPass || "");

Medium

Secret Pattern

Package contains a possible secret pattern.

extensions/index.tsView on unpkg · L476

477 if (p !== undefined) { b.authPass = p; saveConfig(cfg); ctx.ui.notify("Auth saved", "info"); }

478 }

479 if (items[choice].value === "sound") {

480 const s = await ctx.ui.input("Sound (e.g. calypso, alarm, birdsong):", b.sound);

481 if (s !== undefined && s.trim()) { b.sound = s.trim(); saveConfig(cfg); ctx.ui.notify(`Sound: ${b.sound}`, "info"); }

482 }

483 if (items[choice].value === "group") {

484 const g = await ctx.ui.input("Group name:", b.group);

485 if (g !== undefined && g.trim()) { b.group = g.trim(); saveConfig(cfg); ctx.ui.notify(`Group: ${b.group}`, "info"); }

486 }

487 if (items[choice].value === "level") {

488 const levels: Array<"active" | "timeSensitive" | "passive"> = ["active", "timeSensitive", "passive"];

489 const idx = levels.indexOf(b.level);

490 b.level = levels[(idx + 1) % levels.length];

491 saveConfig(cfg);

492 ctx.ui.notify(`Level: ${b.level}`, "info");

493 }

494 if (items[choice].value === "url") {

495 const u = await ctx.ui.input("Click URL (leave empty to clear):", b.url || "");

496 if (u === undefined) continue;

Source & flagged code

1 flagged · loading source

extensions/index.tsView file

476patternName = generic_password severity = medium line = 476 matchedText = const p ..."");

Medium

Secret Pattern

Package contains a possible secret pattern.

extensions/index.tsView on unpkg · L476

Findings

2 Medium2 Low

MediumSecret Patternextensions/index.ts

MediumNetwork

LowFilesystem

LowUrl Strings

Source & flagged code

1 flagged

extensions/index.tsView file

Lines 456-496typescript

456 if (choice === undefined) break;

457

458 if (items[choice].value === "back") break;

459 if (items[choice].value === "toggle") {

460 b.enabled = !b.enabled;

461 saveConfig(cfg);

462 }

463 if (items[choice].value === "key") {

464 const k = await ctx.ui.input("Bark device key:", b.key || "");

465 if (k !== undefined && k.trim()) { b.key = k.trim(); saveConfig(cfg); ctx.ui.notify("Bark key saved", "info"); }

466 }

467 if (items[choice].value === "server") {

468 const s = await ctx.ui.input("Bark server URL:", b.server);

469 if (s !== undefined && s.trim()) { b.server = s.trim(); saveConfig(cfg); ctx.ui.notify("Bark server saved", "info"); }

470 }

471 if (items[choice].value === "auth") {

472 const u = await ctx.ui.input("Auth username (leave empty to clear):", b.authUser || "");

473 if (u === undefined) continue;

474 if (!u.trim()) { delete b.authUser; delete b.authPass; saveConfig(cfg); ctx.ui.notify("Auth cleared", "info"); continue; }

475 b.authUser = u.trim();

476 const p = await ctx.ui.input("Auth password:", b.authPass || "");

Medium

Secret Pattern

Package contains a possible secret pattern.

extensions/index.tsView on unpkg · L476

477 if (p !== undefined) { b.authPass = p; saveConfig(cfg); ctx.ui.notify("Auth saved", "info"); }

478 }

479 if (items[choice].value === "sound") {

480 const s = await ctx.ui.input("Sound (e.g. calypso, alarm, birdsong):", b.sound);

481 if (s !== undefined && s.trim()) { b.sound = s.trim(); saveConfig(cfg); ctx.ui.notify(`Sound: ${b.sound}`, "info"); }

482 }

483 if (items[choice].value === "group") {

484 const g = await ctx.ui.input("Group name:", b.group);

485 if (g !== undefined && g.trim()) { b.group = g.trim(); saveConfig(cfg); ctx.ui.notify(`Group: ${b.group}`, "info"); }

486 }

487 if (items[choice].value === "level") {

488 const levels: Array<"active" | "timeSensitive" | "passive"> = ["active", "timeSensitive", "passive"];

489 const idx = levels.indexOf(b.level);

490 b.level = levels[(idx + 1) % levels.length];

491 saveConfig(cfg);

492 ctx.ui.notify(`Level: ${b.level}`, "info");

493 }

494 if (items[choice].value === "url") {

495 const u = await ctx.ui.input("Click URL (leave empty to clear):", b.url || "");

496 if (u === undefined) continue;