registry / pi-kot / 0.1.28

pi-kot@0.1.28

Browser UI for the pi coding agent — self-hosted React workbench with chat, file browser, terminal, git panel, and session tree.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 78 file(s), 3.24 MB of source, external domains: 127.0.0.1, api.example.com, github.com, ngrok.com, react.dev, registry.npmjs.org, www.w3.org

Source & flagged code

5 flagged

dist/server/turn-diff-builder.jsView file

Lines 283-323javascript

283 try {

284 const oldFile = join(dir, "old");

285 const newFile = join(dir, "new");

286 await writeFile(oldFile, before, "utf8");

287 await writeFile(newFile, after, "utf8");

288 const { stdout } = await runGitDiffNoIndex(projectPath, oldFile, newFile);

289 return relabelNoIndexDiff(stdout, oldFile, newFile, rel);

290 }

291 catch {

292 return undefined;

293 }

294 finally {

295 await rm(dir, { recursive: true, force: true });

296 }

297}

298/**

299 * Run `git diff --no-index <old> <new>` to generate a diff between two

300 * arbitrary files. Returns stdout on success (exit code 1 = differences

301 * found, which is expected). Throws on other errors.

302 */

303async function runGitDiffNoIndex(cwd, oldFile, newFile) {

304 const { spawn } = await import("node:child_process");

305 return new Promise((resolveFn, rejectFn) => {

High

Child Process

Package source references child process execution.

dist/server/turn-diff-builder.jsView on unpkg · L303

306 const child = spawn("git", ["diff", "--no-color", "--no-ext-diff", "--no-index", oldFile, newFile], {

307 cwd,

308 stdio: ["ignore", "pipe", "pipe"],

309 });

310 let stdout = "";

311 let stderr = "";

312 child.stdout.setEncoding("utf8");

313 child.stdout.on("data", (chunk) => { stdout += chunk; });

314 child.stderr.setEncoding("utf8");

315 child.stderr.on("data", (chunk) => { stderr += chunk; });

316 child.on("error", (err) => rejectFn(err));

317 child.on("close", (code) => {

318 // git diff --no-index exits 1 when differences found, 0 when identical

319 if (code === 0 || code === 1)

320 resolveFn({ stdout });

321 else

322 rejectFn(new Error(`git diff --no-index exited ${code}: ${stderr}`));

323 });

dist/server/file-manager.jsView file

Lines 471-511javascript

471 ".md": "markdown",

472 ".markdown": "markdown",

473 ".sh": "shell",

474 ".bash": "shell",

475 ".zsh": "shell",

476 ".fish": "shell",

bin/pi-kot.mjsView file

Lines 126-149javascript

126 process.env.MOUNT_CWD_PROJECT = cwd;

127}

128

129// Log startup info

130const port = process.env.PORT ?? "3333";

131const host = process.env.HOST ?? "0.0.0.0"

dist/server/extension-manager.jsView file

Lines 1-30javascript

1/**

2 * Extension manager — runtime discovery + install for pi.dev extensions.

3 * Scans ~/.pi/agent/ for installed extensions, agents, and packages,

4 * and exposes a curated recommendation catalog optimised for pi-kot.

5 *

6 * Architecture: extension dynamic detection pattern:

7 * detect → activate — UI features light up based on what's installed.

8 *

9 * Update checking:

10 * checkExtensionUpdates() compares installed vs. npm registry latest.

11 * updateExtension() runs npm install to upgrade to latest.

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

Source & flagged code

5 flagged · loading source

dist/server/turn-diff-builder.jsView file

303async function runGitDiffNoIndex(cwd, oldFile, newFile) { L304: const { spawn } = await import("node:child_process"); L305: return new Promise((resolveFn, rejectFn) => {

High

Child Process

Package source references child process execution.

dist/server/turn-diff-builder.jsView on unpkg · L303

dist/server/file-manager.jsView file

491".r": "r", L492: ".ps1": "powershell", L493: ".psm1": "powershell",

High

Shell

Package source references shell execution.

dist/server/file-manager.jsView on unpkg · L491

bin/pi-kot.mjsView file

146} L147: const { start } = await import(pathToFileURL(serverEntry).href); L148: await start();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/pi-kot.mjsView on unpkg · L146

dist/server/extension-manager.jsView file

10* checkExtensionUpdates() compares installed vs. npm registry latest. L11: * updateExtension() runs npm install to upgrade to latest. L12: */ ... L16: import { homedir } from "node:os"; L17: import { execSync } from "node:child_process"; L18: // ── Path helpers ────────────────────────────────────────────────────

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/server/extension-manager.jsView on unpkg · L10

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

Findings

4 High4 Medium5 Low

HighChild Processdist/server/turn-diff-builder.js

HighShelldist/server/file-manager.js

HighRuntime Package Installdist/server/extension-manager.js

HighShips High Entropy Blobdist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2

MediumDynamic Requirebin/pi-kot.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/server/turn-diff-builder.jsView file

Lines 283-323javascript

283 try {

284 const oldFile = join(dir, "old");

285 const newFile = join(dir, "new");

286 await writeFile(oldFile, before, "utf8");

287 await writeFile(newFile, after, "utf8");

288 const { stdout } = await runGitDiffNoIndex(projectPath, oldFile, newFile);

289 return relabelNoIndexDiff(stdout, oldFile, newFile, rel);

290 }

291 catch {

292 return undefined;

293 }

294 finally {

295 await rm(dir, { recursive: true, force: true });

296 }

297}

298/**

299 * Run `git diff --no-index <old> <new>` to generate a diff between two

300 * arbitrary files. Returns stdout on success (exit code 1 = differences

301 * found, which is expected). Throws on other errors.

302 */

303async function runGitDiffNoIndex(cwd, oldFile, newFile) {

304 const { spawn } = await import("node:child_process");

305 return new Promise((resolveFn, rejectFn) => {

High

Child Process

Package source references child process execution.

dist/server/turn-diff-builder.jsView on unpkg · L303

306 const child = spawn("git", ["diff", "--no-color", "--no-ext-diff", "--no-index", oldFile, newFile], {

307 cwd,

308 stdio: ["ignore", "pipe", "pipe"],

309 });

310 let stdout = "";

311 let stderr = "";

312 child.stdout.setEncoding("utf8");

313 child.stdout.on("data", (chunk) => { stdout += chunk; });

314 child.stderr.setEncoding("utf8");

315 child.stderr.on("data", (chunk) => { stderr += chunk; });

316 child.on("error", (err) => rejectFn(err));

317 child.on("close", (code) => {

318 // git diff --no-index exits 1 when differences found, 0 when identical

319 if (code === 0 || code === 1)

320 resolveFn({ stdout });

321 else

322 rejectFn(new Error(`git diff --no-index exited ${code}: ${stderr}`));

323 });

dist/server/file-manager.jsView file

Lines 471-511javascript

471 ".md": "markdown",

472 ".markdown": "markdown",

473 ".sh": "shell",

474 ".bash": "shell",

475 ".zsh": "shell",

476 ".fish": "shell",

bin/pi-kot.mjsView file

Lines 126-149javascript

126 process.env.MOUNT_CWD_PROJECT = cwd;

127}

128

129// Log startup info

130const port = process.env.PORT ?? "3333";

131const host = process.env.HOST ?? "0.0.0.0"

dist/server/extension-manager.jsView file

Lines 1-30javascript

1/**

2 * Extension manager — runtime discovery + install for pi.dev extensions.

3 * Scans ~/.pi/agent/ for installed extensions, agents, and packages,

4 * and exposes a curated recommendation catalog optimised for pi-kot.

5 *

6 * Architecture: extension dynamic detection pattern:

7 * detect → activate — UI features light up based on what's installed.

8 *

9 * Update checking:

10 * checkExtensionUpdates() compares installed vs. npm registry latest.

11 * updateExtension() runs npm install to upgrade to latest.

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg