registry / pi-kot / 0.1.14

pi-kot@0.1.14

Browser UI for the pi coding agent — self-hosted React workbench with chat, file browser, terminal, git panel, and session tree.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 57 file(s), 788 KB of source, external domains: github.com, react.dev, registry.npmjs.org, www.w3.org

Oversized source lightweight scan

dist/client/assets/index-Cu0xGavc.js2.23 MB file, sampled 256 KB

NetworkChildProcessWebSocketObfuscatedHighEntropyStringsMinifiedUrlStringsgithub.comreact.devwww.w3.org

Source & flagged code

5 flagged

dist/server/git-runner.jsView file

Lines 1-21javascript

1import { execFile } from "node:child_process";

2import { realpath } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/server/git-runner.jsView on unpkg · L1

3import { homedir } from "node:os";

4import { resolve } from "node:path";

5import { promisify } from "node:util";

6import { assertInsideRoot } from "./file-manager.js";

7const execFileAsync = promisify(execFile);

8/**

9 * Thin wrapper around `git` for the pi-kot's git panel.

10 *

11 * Rules:

12 * - NEVER `exec` with string interpolation. Always `execFile` with

13 * an args array. The project path comes from our own

14 * `project-manager` (validated against WORKSPACE_PATH); commit

15 * messages and remote/branch names come from user input — args

16 * arrays make shell-quoting moot regardless of content.

17 * - "Not a git repo" → return empty / sensible default, NEVER 500.

18 * Users can have non-git project folders and the panel should

19 * just sit quiet, not error.

20 * - User-visible errors carry a short message we synthesize from

21 * the stderr; we never blast raw stderr at the client (would

bin/pi-kot.mjsView file

Lines 114-137javascript

114process.env.CLIENT_DIST_PATH ??= resolve(packageRoot, "dist", "client");

115process.env.NODE_ENV ??= "production";

116

117// Auto-mount the current working directory as a project if it's not the

118// workspace root itself. This makes `npx pi-kot` from any project folder

119// show that folder in the project list automatically.

120const cwd

dist/server/extension-manager.jsView file

Lines 1-30javascript

1/**

2 * Extension manager — runtime discovery + install for pi.dev extensions.

3 * Scans ~/.pi/agent/ for installed extensions, agents, and packages,

4 * and exposes a curated recommendation catalog optimised for pi-kot.

5 *

6 * Architecture: extension dynamic detection pattern:

7 * detect → activate — UI features light up based on what's installed.

8 *

9 * Update checking:

10 * checkExtensionUpdates() compares installed vs. npm registry latest.

11 * updateExtension() runs npm install to upgrade to latest.

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/client/assets/index-Cu0xGavc.jsView file

•path = dist/client/assets/index-Cu0xGavc.js kind = oversized_source_file sizeBytes = 2335097 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/client/assets/index-Cu0xGavc.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/server/git-runner.jsView file

1import { execFile } from "node:child_process"; L2: import { realpath } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/server/git-runner.jsView on unpkg · L1

bin/pi-kot.mjsView file

134const serverEntry = resolve(packageRoot, "dist", "server", "index.js"); L135: const { start } = await import(pathToFileURL(serverEntry).href); L136: await start();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/pi-kot.mjsView on unpkg · L134

dist/server/extension-manager.jsView file

10* checkExtensionUpdates() compares installed vs. npm registry latest. L11: * updateExtension() runs npm install to upgrade to latest. L12: */ ... L16: import { homedir } from "node:os"; L17: import { execSync } from "node:child_process"; L18: // ── Path helpers ────────────────────────────────────────────────────

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/server/extension-manager.jsView on unpkg · L10

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/client/assets/index-Cu0xGavc.jsView file

•path = dist/client/assets/index-Cu0xGavc.js kind = oversized_source_file sizeBytes = 2335097 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/client/assets/index-Cu0xGavc.jsView on unpkg

Findings

5 High4 Medium4 Low

HighChild Processdist/server/git-runner.js

HighShell

HighRuntime Package Installdist/server/extension-manager.js

HighShips High Entropy Blobdist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2

HighOversized Source Filedist/client/assets/index-Cu0xGavc.js

MediumDynamic Requirebin/pi-kot.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/server/git-runner.jsView file

Lines 1-21javascript

1import { execFile } from "node:child_process";

2import { realpath } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/server/git-runner.jsView on unpkg · L1

3import { homedir } from "node:os";

4import { resolve } from "node:path";

5import { promisify } from "node:util";

6import { assertInsideRoot } from "./file-manager.js";

7const execFileAsync = promisify(execFile);

8/**

9 * Thin wrapper around `git` for the pi-kot's git panel.

10 *

11 * Rules:

12 * - NEVER `exec` with string interpolation. Always `execFile` with

13 * an args array. The project path comes from our own

14 * `project-manager` (validated against WORKSPACE_PATH); commit

15 * messages and remote/branch names come from user input — args

16 * arrays make shell-quoting moot regardless of content.

17 * - "Not a git repo" → return empty / sensible default, NEVER 500.

18 * Users can have non-git project folders and the panel should

19 * just sit quiet, not error.

20 * - User-visible errors carry a short message we synthesize from

21 * the stderr; we never blast raw stderr at the client (would

bin/pi-kot.mjsView file

Lines 114-137javascript

114process.env.CLIENT_DIST_PATH ??= resolve(packageRoot, "dist", "client");

115process.env.NODE_ENV ??= "production";

116

117// Auto-mount the current working directory as a project if it's not the

118// workspace root itself. This makes `npx pi-kot` from any project folder

119// show that folder in the project list automatically.

120const cwd

dist/server/extension-manager.jsView file

Lines 1-30javascript

1/**

2 * Extension manager — runtime discovery + install for pi.dev extensions.

3 * Scans ~/.pi/agent/ for installed extensions, agents, and packages,

4 * and exposes a curated recommendation catalog optimised for pi-kot.

5 *

6 * Architecture: extension dynamic detection pattern:

7 * detect → activate — UI features light up based on what's installed.

8 *

9 * Update checking:

10 * checkExtensionUpdates() compares installed vs. npm registry latest.

11 * updateExtension() runs npm install to upgrade to latest.

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/client/assets/index-Cu0xGavc.jsView file

•path = dist/client/assets/index-Cu0xGavc.js kind = oversized_source_file sizeBytes = 2335097 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/client/assets/index-Cu0xGavc.jsView on unpkg