registry / pi-crew / 0.9.34

pi-crew@0.9.34

Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 482 file(s), 3.92 MB of source, external domains: api.anthropic.com, api.github.com, api.z.ai, evil.example, www.minimax.io

Oversized source lightweight scan

dist/index.mjs3.02 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringsapi.github.comapi.z.aiwww.minimax.io

Source & flagged code

10 flagged

package.jsonView file

Lines 53-93json

53 "LICENSE",

54 "NOTICE.md"

55 ],

56 "scripts": {

57 "check": "npm run ci",

58 "ci": "npm run typecheck && npm run lint && npm run format:check && npm run check:conflict-markers && npm run check:lazy-imports && npm run check:bundle-staleness && npm test && npm pack --dry-run",

59 "check:lazy-imports": "node scripts/check-lazy-imports.mjs",

60 "check:bundle-staleness": "node scripts/check-bundle-staleness.mjs",

61 "check:conflict-markers": "node scripts/check-conflict-markers.mjs",

62 "typecheck": "tsc --noEmit && node --experimental-strip-types -e \"await import('./index.ts'); console.log('strip-types import ok')\"",

63 "lint": "biome check --linter-enabled=true --formatter-enabled=false --max-diagnostics=50 --diagnostic-level=error .",

64 "format:check": "biome format .",

65 "test": "npm run test:unit && npm run test:integration",

66 "test:unit": "node scripts/test-runner.mjs --test-concurrency=4 --test-timeout=180000 --test-force-exit test/unit/*.test.ts",

67 "test:watch": "tsx --watch --test --test-concurrency=4 --test-timeout=30000 --test-force-exit test/unit/*.test.ts",

68 "test:integration": "node scripts/test-runner.mjs --test-concurrency=1 --test-timeout=300000 test/integration/*.test.ts",

69 "test:smoke": "node scripts/test-runner.mjs --test-concurrency=1 --test-timeout=180000 test/smoke/*.smoke.ts",

70 "build:bundle": "node scripts/build-bundle.mjs",

71 "watch:bundle": "node scripts/watch-bundle.mjs",

72 "build:bundle:once": "node scripts/watch-bundle.mjs --once",

73 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L73

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L73

74 "install:crew-font": "node scripts/install-crew-vibes-font.mjs",

75 "build:crew-font": "python scripts/build-crew-vibes-font.py",

76 "bench": "node scripts/run-bench.mjs",

77 "bench:check": "node scripts/bench-check.mjs",

78 "test:new": "tsx --test --test-concurrency=4 --test-timeout=30000 --test-force-exit test/unit/*.test.ts",

79 "test:changed": "node scripts/test-changed.mjs",

80 "bench:capture": "node scripts/run-bench.mjs && node -e \"require('node:fs').copyFileSync('test/bench/results.json','test/bench/baseline.json')\"",

81 "profile:startup": "node scripts/profile-startup.mjs",

82 "smoke:pi": "pi install .",

83 "smoke:release": "node scripts/release-smoke.mjs"

84 },

85 "exports": {

86 "./schema.json": "./schema.json",

87 "./workflow": {

88 "types": "./types/dwf.d.ts"

89 }

90 },

91 "pi": {

92 "extensions": [

93 "./index.ts"

docs/followup-plan-2026-05-12.mdView file

Lines 219-266markdown

219**Severity:** Medium | **Effort:** ~20 minutes | **File:** missing `test/unit/artifact-store.test.ts`

220

221**Problem:**

222- The BUG-002 fix changed the hash from `options.content` to `redactSecretString(options.content)` ensuring `contentHash` matches the bytes on disk.

223- There is no test verifying this. There's `api-artifact-security.test.ts` but it doesn't assert the hash.

224

225**Proposed fix:** create

scripts/profile-startup.mjsView file

Lines 20-60javascript

21const root = path.resolve(import.meta.dirname, "..");

22const profileDir = path.join(root, ".profile");

23const timestamp = new Date().toISOString

scripts/build-crew-vibes-font.pyView file

•path = scripts/build-crew-vibes-font.py kind = build_helper sizeBytes = 10677 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-crew-vibes-font.pyView on unpkg

dist/index.mjsView file

•path = dist/index.mjs kind = oversized_source_file sizeBytes = 3164389 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.mjsView on unpkg

src/runtime/async-runner.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = pi-crew@0.9.29 matchedIdentity = npm:cGktY3Jldw:0.9.29 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/runtime/async-runner.tsView on unpkg

docs/code-review-2026-05-11.mdView file

Lines 151-191markdown

151```

152Guarantees `contentHash === sha256(fs.readFileSync(filePath))`. You lose the ability to "trace back to the pre-redaction source" — but that is the safe behavior for the artifact store.

153

154**Option B — Store both fields if needed:**

155```ts

156return {

157 ...,

158 contentHash, // pre-redaction (source-of-truth)

159 storedContentHash: hashContent(content), // post-redaction (matches the file)

160 sizeBytes: stats.size,

161};

162

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

docs/followup-plan-2026-05-12.mdView file

239patternName = aws_access_key severity = critical line = 239 matchedText = content:...xt",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

docs/followup-plan-2026-05-12.mdView on unpkg · L239

239patternName = aws_access_key severity = critical line = 239 matchedText = content:...xt",

Critical

Secret Pattern

AWS access key ID in docs/followup-plan-2026-05-12.md

docs/followup-plan-2026-05-12.mdView on unpkg · L239

246patternName = aws_access_key severity = critical line = 246 matchedText = assert.o..."));

Critical

Secret Pattern

AWS access key ID in docs/followup-plan-2026-05-12.md

docs/followup-plan-2026-05-12.mdView on unpkg · L246

scripts/profile-startup.mjsView file

40const start = performance.now(); L41: const { registerPiTeams } = await import(${JSON.stringify(registerImportSpec)}); L42: const importMs = performance.now() - start;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/profile-startup.mjsView on unpkg · L40

scripts/build-crew-vibes-font.pyView file

•path = scripts/build-crew-vibes-font.py kind = build_helper sizeBytes = 10677 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-crew-vibes-font.pyView on unpkg

dist/index.mjsView file

•path = dist/index.mjs kind = oversized_source_file sizeBytes = 3164389 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.mjsView on unpkg

src/runtime/async-runner.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/runtime/async-runner.tsView on unpkg

docs/code-review-2026-05-11.mdView file

171patternName = aws_access_key severity = critical line = 171 matchedText = content:...EF",

Critical

Secret Pattern

AWS access key ID in docs/code-review-2026-05-11.md

docs/code-review-2026-05-11.mdView on unpkg · L171

Findings

4 Critical3 High6 Medium4 Low

CriticalCritical Secretdocs/followup-plan-2026-05-12.md

CriticalSecret Patterndocs/followup-plan-2026-05-12.md

CriticalSecret Patterndocs/code-review-2026-05-11.md

HighInstall Time Lifecycle Scriptspackage.json

HighOversized Source Filedist/index.mjs

HighPrevious Version Dangerous Deltasrc/runtime/async-runner.ts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/profile-startup.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/build-crew-vibes-font.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

10 flagged

package.jsonView file

Lines 53-93json

53 "LICENSE",

54 "NOTICE.md"

55 ],

56 "scripts": {

57 "check": "npm run ci",

59 "check:lazy-imports": "node scripts/check-lazy-imports.mjs",

60 "check:bundle-staleness": "node scripts/check-bundle-staleness.mjs",

61 "check:conflict-markers": "node scripts/check-conflict-markers.mjs",

62 "typecheck": "tsc --noEmit && node --experimental-strip-types -e \"await import('./index.ts'); console.log('strip-types import ok')\"",

63 "lint": "biome check --linter-enabled=true --formatter-enabled=false --max-diagnostics=50 --diagnostic-level=error .",

64 "format:check": "biome format .",

65 "test": "npm run test:unit && npm run test:integration",

66 "test:unit": "node scripts/test-runner.mjs --test-concurrency=4 --test-timeout=180000 --test-force-exit test/unit/*.test.ts",

67 "test:watch": "tsx --watch --test --test-concurrency=4 --test-timeout=30000 --test-force-exit test/unit/*.test.ts",

68 "test:integration": "node scripts/test-runner.mjs --test-concurrency=1 --test-timeout=300000 test/integration/*.test.ts",

69 "test:smoke": "node scripts/test-runner.mjs --test-concurrency=1 --test-timeout=180000 test/smoke/*.smoke.ts",

70 "build:bundle": "node scripts/build-bundle.mjs",

71 "watch:bundle": "node scripts/watch-bundle.mjs",

72 "build:bundle:once": "node scripts/watch-bundle.mjs --once",

73 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L73

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L73

74 "install:crew-font": "node scripts/install-crew-vibes-font.mjs",

75 "build:crew-font": "python scripts/build-crew-vibes-font.py",

76 "bench": "node scripts/run-bench.mjs",

77 "bench:check": "node scripts/bench-check.mjs",

78 "test:new": "tsx --test --test-concurrency=4 --test-timeout=30000 --test-force-exit test/unit/*.test.ts",

79 "test:changed": "node scripts/test-changed.mjs",

80 "bench:capture": "node scripts/run-bench.mjs && node -e \"require('node:fs').copyFileSync('test/bench/results.json','test/bench/baseline.json')\"",

81 "profile:startup": "node scripts/profile-startup.mjs",

82 "smoke:pi": "pi install .",

83 "smoke:release": "node scripts/release-smoke.mjs"

84 },

85 "exports": {

86 "./schema.json": "./schema.json",

87 "./workflow": {

88 "types": "./types/dwf.d.ts"

89 }

90 },

91 "pi": {

92 "extensions": [

93 "./index.ts"

docs/followup-plan-2026-05-12.mdView file

Lines 219-266markdown

219**Severity:** Medium | **Effort:** ~20 minutes | **File:** missing `test/unit/artifact-store.test.ts`

220

221**Problem:**

222- The BUG-002 fix changed the hash from `options.content` to `redactSecretString(options.content)` ensuring `contentHash` matches the bytes on disk.

223- There is no test verifying this. There's `api-artifact-security.test.ts` but it doesn't assert the hash.

224

225**Proposed fix:** create

scripts/profile-startup.mjsView file

Lines 20-60javascript

21const root = path.resolve(import.meta.dirname, "..");

22const profileDir = path.join(root, ".profile");

23const timestamp = new Date().toISOString

scripts/build-crew-vibes-font.pyView file

•path = scripts/build-crew-vibes-font.py kind = build_helper sizeBytes = 10677 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-crew-vibes-font.pyView on unpkg

dist/index.mjsView file

•path = dist/index.mjs kind = oversized_source_file sizeBytes = 3164389 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.mjsView on unpkg

src/runtime/async-runner.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/runtime/async-runner.tsView on unpkg

docs/code-review-2026-05-11.mdView file

Lines 151-191markdown

151```

152Guarantees `contentHash === sha256(fs.readFileSync(filePath))`. You lose the ability to "trace back to the pre-redaction source" — but that is the safe behavior for the artifact store.

153

154**Option B — Store both fields if needed:**

155```ts

156return {

157 ...,

158 contentHash, // pre-redaction (source-of-truth)

159 storedContentHash: hashContent(content), // post-redaction (matches the file)

160 sizeBytes: stats.size,

161};

162