Loading npm security reports…

pi-maestro-flow@0.29.0: Malicious npm security report (Block) | LPM Firewall

registry / pi-maestro-flow / 0.29.0

pi-maestro-flow@0.29.0

All-in-one multi-agent orchestration for the Pi coding agent — parallel teammate dispatch, goals, plans, knowledge system, MCP/LSP/browser, and cockpit visualization in a single install

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Installation automatically changes global Pi-agent configuration and registers additional extension packages. It also installs workflow resources under the user's Maestro home.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm installation, through postinstall.

Impact

A package install alters the agent's keybindings and active package list without an explicit setup command.

Mechanism

Automatic mutation of global AI-agent configuration and extension registration.

Attack narrative

On npm installation, the package automatically runs scripts that modify the user's global Pi-agent keybindings and settings. The settings mutation registers dependency directories as Pi packages, enabling their extensions in the agent control surface. A separate lifecycle script invokes a dependency CLI or copies workflow resources into the global Maestro directory. These are unconsented install-time changes outside the installed package.

AI rationale

The package has a concrete automatic postinstall path that mutates global AI-agent configuration and activates companion extensions. This meets the install-hook abuse boundary even though the inspected code did not show exfiltration.

Evidence

package.jsonscripts/configure-keybindings.mjsscripts/register-companion-packages.mjsscripts/install-workflows.mjs~/.pi/agent/keybindings.json~/.pi/agent/settings.json~/.pi/agent/pi-maestro-flow-companions.json~/.maestro/workflows

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/configure-keybindings.mjs && node scripts/install-workflows.mjs && node scripts/register-companion-packages.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/configure-keybindings.mjs && node scripts/install-workflows.mjs && node scripts/register-companion-packages.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•Remote tarball dependency specs: @konbakuyomu/smart-search@https://github.[redacted].tar.gz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

optional/browser-bridge/background.jsView file

197world: 'MAIN', L198: func: async (s) => eval(s), L199: args: [wrapExecScript(msg.code)],

Low

Eval

Package source references a known benign dynamic code generation pattern.

optional/browser-bridge/background.jsView on unpkg · L197

scripts/simulate-272k-stuck.mjsView file

24const AM = process.env.AM_MODULE ?? join(ROOT, "src/compaction/auto-compaction.ts"); L25: const { createMidTurnAutoCompaction, estimateContextTokens, endsWithCompleteToolResultBatch } = await import(pathToFileURL(AM).href); L26: const { deriveCompactionThreshold } = await import(pathToFileURL(join(dirname(AM), "compaction-threshold.ts")).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/simulate-272k-stuck.mjsView on unpkg · L24

src/tools/browser/manager.tsView file

1import { spawn } from "node:child_process"; L2: import { createHash } from "node:crypto"; ... L67: export interface BrowserRunOutput { L68: displays: Array<{ type: "text"; text: string } | { type: "image"; data: string; mimeType: string }>; L69: returnValue: unknown; ... L998: // reinterpret an own __proto__ key as a prototype setter. L999: return `return await (${pageFunction.toString()})(...JSON.parse(${JSON.stringify(serializedArgs)}));`; L1000: } ... L1603: // and a leftover browser from a crashed session can be detected and reused. L1604: const BROWSER_PROFILE_BASE = process.env.PI_BROWSER_PROFILES_DIR ?? path.join(os.homedir(), ".pi", "browser-profiles"); L1605: ... L1624: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/tools/browser/manager.tsView on unpkg · L1

src/mcpx-bridge.tsView file

9import { randomUUID } from "node:crypto"; L10: import { spawn, spawnSync } from "node:child_process"; L11: import { closeSync, existsSync, openSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs"; L12: import { isIP } from "node:net"; L13: import { homedir } from "node:os"; ... L29: L30: const bridgeDisabled = () => process.env.PI_MCPX_BRIDGE === "0"; L31: const registeredPaths = new Set<string>(); ... L56: function absoluteRoot(root: string | undefined): string { L57: const rawRoot = root ?? process.cwd(); L58: return isAbsolute(rawRoot) ? resolve(rawRoot) : resolve(process.cwd(), rawRoot); ... L227: const octets = hostname.split(".").map(Number);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/mcpx-bridge.tsView on unpkg · L9

optional/skills/scholar-thesis-docx/scripts/audit_docx_ooxml.pyView file

•path = optional/skills/scholar-thesis-docx/scripts/audit_docx_ooxml.py kind = build_helper sizeBytes = 18004 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

optional/skills/scholar-thesis-docx/scripts/audit_docx_ooxml.pyView on unpkg

.pi/skills/team-swarm/scripts/test_aco.pyView file

•path = .pi/skills/team-swarm/scripts/test_aco.py kind = payload_in_excluded_dir sizeBytes = 19256 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.pi/skills/team-swarm/scripts/test_aco.pyView on unpkg

src/mcp/host-html-template.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/mcp/host-html-template.ts#virtual:normalized:round1View on unpkg

src/gateway/pi-config-apply.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = pi-maestro-flow@0.24.0 matchedIdentity = npm:cGktbWFlc3Ryby1mbG93:0.24.0 similarity = 0.517 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/gateway/pi-config-apply.tsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 1-33json

1{

2 "name": "pi-maestro-flow",

3 "version": "0.29.0",

4 "description": "All-in-one multi-agent orchestration for the Pi coding agent — parallel teammate dispatch, goals, plans, knowledge system, MCP/LSP/browser, and cockpit visualization in a single install",

5 "type": "module",

6 "bin": {

7 "pi-maestro-gateway": "bin/pi-maestro-gateway.mjs"

8 },

9 "engines": {

10 "node": ">=22.19.0"

11 },

12 "scripts": {

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg · L12

13 "postinstall": "node scripts/configure-keybindings.mjs && node scripts/install-workflows.mjs && node scripts/register-companion-packages.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "prepack": "node scripts/prepare-package-skills.mjs && node ../../scripts/bundle-settings-core.mjs",

15 "postpack": "node ../../scripts/bundle-settings-core.mjs --clean && node scripts/prepare-package-skills.mjs --clean",

16 "test:install": "node --test test/configure-keybindings.test.mjs test/install-workflows.test.mjs test/register-companion-packages.test.mjs",

17 "test:package": "node scripts/verify-maestro-run-capabilities.mjs && node --experimental-transform-types --test test/prepare-package-skills.test.mjs test/package-resources.test.mjs test/package-resources-runtime.test.ts && node --test test/sdk-resolution-contract.test.mjs",

18 "test:conversion": "node --experimental-transform-types --test test/convert-pi.test.mjs test/maestro-run-capabilities.test.mjs test/skill-contract-lint.test.ts",

19 "check:maestro-run-cli": "node scripts/verify-maestro-run-capabilities.mjs",

20 "test:todo": "node --experimental-transform-types --test test/skill-loader.test.ts test/skill-manager.test.ts test/todo.test.ts test/todo-overlay.test.ts test/todo-cross-tool.test.ts test/todo-prompt-context.test.ts test/cockpit-ownership.test.ts",

21 "test:compaction": "node --experimental-transform-types --test test/compaction.test.ts test/compaction-image.test.ts test/compaction-settings.test.ts test/compaction-tui.test.ts test/tool-result-spill.test.ts test/lossless.test.ts test/cache-gate.test.ts test/relevance.test.ts test/dedup.test.ts test/content-detector.test.ts",

22 "test:settings": "node --experimental-transform-types --test test/settings-provider.test.ts test/api-manager-settings-provider.test.ts test/mcp-settings-provider.test.ts test/skills-settings-provider.test.ts test/smart-search-settings-provider.test.ts test/teammate-backends-settings-provider.test.ts test/settings-provider-wiring.test.ts test/settings-catalogs.test.ts test/tui-locale.test.ts",

23 "test:gui": "node --experimental-transform-types --test test/gui-server.test.ts test/gui-state.test.ts test/gui-events.test.ts test/gui-tools.test.ts test/gui-invoke.test.ts test/gui-e2e.test.ts",

24 "test:hooks": "node --experimental-transform-types --test test/hooks.test.ts",

25 "test:permissions": "node --experimental-transform-types --test test/permissions.test.ts test/ask.test.ts test/ask-sessionbar-integration.test.ts test/approval-mode.test.ts test/notify-mode.test.ts test/teammate-relay-ipc.test.ts test/direct-teammate-runtime.test.ts",

26 "test:providers": "node --experimental-transform-types --test test/api-provider-config.test.ts test/api-model-editor.test.ts test/explore-config-manager.test.ts test/cost-backfill.test.ts test/model-discovery.test.ts",

27 "test:next-suggest": "node --experimental-transform-types --test test/next-suggest.test.ts",

28 "test:mcp": "node --experimental-transform-types --test test/mcp-config.test.ts test/mcp-manager.test.ts test/mcp-server-manager.test.ts test/mcp-lifecycle-leases.test.ts test/mcp-ui-server.test.ts",

29 "test:goal": "node --experimental-transform-types --test test/goal.test.ts test/goal-verification-timeout.test.ts",

30 "test:bash-bg": "node --experimental-transform-types --test test/bash-bg.test.ts",

31 "test:plan": "node --experimental-transform-types --test test/plan-store.test.ts test/plan-editor.test.ts test/plan-decompose.test.ts test/plan-refine.test.ts test/plan-lifecycle.test.ts test/plan-model.test.ts test/plan-todo-integration.test.ts test/session-artifact.test.ts test/statusline.test.ts",

32 "test:flow-schedule": "node --experimental-transform-types --test --test-concurrency=2 test/flow-schedule-schema.test.ts test/flow-schedule-store.test.ts test/flow-schedule-machine.test.ts test/flow-schedule-actor.test.ts test/flow-schedule-runtime.test.ts test/flow-schedule-tool.test.ts test/flow-schedule-legacy.test.ts test/flow-schedule-e2e.test.ts",

33 "test:session": "node --experimental-transform-types --test test/session-bridge.test.ts test/session-export.test.ts test/todo-projection.test.ts test/workflow-coordinator.test.ts test/run-recovery.test.ts test/session-tui.test.ts test/ui-projection.test.ts test/skill-contract-lint.test.ts",

optional/browser-bridge/background.jsView file

Lines 177-217javascript

177 [STORAGE_INSTALLATION_KEY]: credentials.installationId,

178 });

179 return credentials;

180}

181

182// --- Command handlers (one per cmd field) ---

183

184async function handleExec(msg

scripts/simulate-272k-stuck.mjsView file

Lines 4-44javascript

4 * 数据：dongdiankaifa9 / gpt-5.6-sol / 2026-07-31 真实会话（轨迹首个 nudge 穿越点

5 * 原始估算 134,521 ≈ 用户报告的 134,490

src/tools/browser/manager.tsView file

Lines 1-21typescript

1import { spawn } from "node:child_process";

2import { createHash } from "node:crypto";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/tools/browser/manager.tsView on unpkg · L1

3import * as fs from

src/mcpx-bridge.tsView file

Lines 1-29typescript

1/**

2 * `/mcpx` compatibility facade for the built-in Pi Maestro Gateway.

3 *

4 * Existing exports and the ~/.mcpx config path remain available for one

5 * compatibility cycle, while lifecycle and workspace state are owned by the

6 * packaged Gateway. Opt out with PI_MCPX_BRIDGE=0.

7 */

8

9import { randomUUID } from "node:crypto";

optional/skills/scholar-thesis-docx/scripts/audit_docx_ooxml.pyView file

•path = optional/skills/scholar-thesis-docx/scripts/audit_docx_ooxml.py kind = build_helper sizeBytes = 18004 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

optional/skills/scholar-thesis-docx/scripts/audit_docx_ooxml.pyView on unpkg

.pi/skills/team-swarm/scripts/test_aco.pyView file

•path = .pi/skills/team-swarm/scripts/test_aco.py kind = payload_in_excluded_dir sizeBytes = 19256 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.pi/skills/team-swarm/scripts/test_aco.pyView on unpkg

src/mcp/host-html-template.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/mcp/host-html-template.ts#virtual:normalized:round1View on unpkg

src/gateway/pi-config-apply.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = pi-maestro-flow@0.24.0 matchedIdentity = npm:cGktbWFlc3Ryby1mbG93:0.24.0 similarity = 0.517 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/gateway/pi-config-apply.tsView on unpkg