registry / pi-mega-compact / 0.4.16

pi-mega-compact@0.4.16

Layered, local, vector-backed context compressor for pi — supersede/collapse/cluster compaction with deduped inline recall.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The extension persists its own compaction state and offers an explicitly invoked localhost dashboard; optional model requests are loopback-restricted.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Pi/OpenClaw extension runtime; dashboard only after the user invokes its slash command.

Impact

Writes package state under its configured or per-repository state directory; no credential harvesting, exfiltration, destructive action, or foreign agent-control mutation found.

Mechanism

Local context compaction, state persistence, and optional loopback services.

Rationale

Source inspection shows a package-owned agent extension with no install-time execution. Network and child-process features are limited to user-triggered local dashboard functionality or localhost-only BYO model services, with no concrete malicious chain.

Evidence

package.jsonextensions/mega-compact.tsextensions/openclaw-mega-compact.tsextensions/mega-dashboard-cmds.tsextensions/dashboard-server.tssrc/httpEmbedder.tssrc/dedup/raptor/summarizer.ts.pi/mega-compact

Network endpoints1

127.0.0.1:11434/api/generate

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has only prepublishOnly; no install lifecycle hook.
extensions/mega-dashboard-cmds.ts starts its server only through explicit dashboard commands.
extensions/dashboard-server.ts binds solely to 127.0.0.1 on ports 9320–9329.
src/httpEmbedder.ts rejects non-loopback embedding URLs.
src/dedup/raptor/summarizer.ts permits only localhost/127.0.0.1 Ollama.
Child processes run package-local dashboard or loopback request workers; no remote payload path found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 150 file(s), 1.08 MB of source, external domains: 127.0.0.1

Source & flagged code

5 flagged

dist/extensions/mega-dashboard-cmds.jsView file

Lines 1-30javascript

1/**

2 * mega-dashboard-cmds.ts — the local web-dashboard slash commands.

3 *

4 * Spawns / discovers / stops the optional localhost dashboard server

5 * (extensions/dashboard-server.ts) as a detached child process. All network

6 * usage here is loopback-only and audited via // guardrails-allow PREVENT-PI-004.

7 */

8import { join, dirname, sep } from "node:path";

9import { fileURLToPath } from "node:url";

10import { existsSync, writeFileSync, readFileSync, unlinkSync } from "node:fs";

11import { spawn } from "node:child_process"; // guardrails-allow PREVENT-PI-004: spawns the optional, user-triggered localhost dashboard server only

12/** Register the dashboard server lifecycle commands. */

High

Child Process

Package source references child process execution.

dist/extensions/mega-dashboard-cmds.jsView on unpkg · L10

13export function registerDashboardCommands(pi, runtime) {

14 const portFile = join(runtime.currentStateDir, "port.pid");

15 const runnerFile = join(runtime.currentStateDir, "_dashboard-runner.mjs");

16 const launchLog = join(runtime.currentStateDir, "_dashboard-launch.log");

17 // Whether the runner must be spawned with --experimental-strip-types (true only

18 // when we fall back to the .ts source outside node_modules; false when using

19 // the shipped compiled dist/extensions/dashboard-server.js).

20 let dashboardNeedsStrip = false;

21 // The dashboard server binds 9320–9329 (TARGET_PORT..TARGET_PORT+PORT_RANGE-1

22 // in dashboard-server.js). Probe each for a live /api/snapshot so we can detect

23 // readiness even when port.pid landed in a different state dir than we poll.

24 async function findLivePort() {

25 for (let port = 9320; port <= 9329; port++) {

26 try {

27 const res = await fetch(`http://localhost:${port}/api/snapshot`, { signal: AbortSignal.timeout(800) }); // guardrails-allow PREVENT-PI-004: localhost liveness probe of the dashboard server this extension spawned

28 if (res.ok)

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/extensions/mega-dashboard-cmds.jsView on unpkg · L10

29 return port;

30 }

dist/src/dedup/raptor/summarizer.jsView file

Lines 1-78javascript

1/**

2 * summarizer.ts — per-cluster summary for the RAPTOR tree (Sprint 13, Phase 6).

3 *

4 * Default: pure extractive (deterministic, zero network, zero model) reusing

5 * extractive.ts. Optional: a LOCAL Ollama model (llama3.2:3b by default) when

6 * MEGACOMPACT_RAPTOR_MODEL is set — localhost only, same PREVENT-PI-004

7 * exception class as HttpEmbedder/the dashboard. No remote API is ever called.

8 *

9 * The summarizer returns structured text + a token estimate. Faithfulness is

10 * enforced downstream by guardrails.ts — this module only produces candidates.

11 */

dist/extensions/mega-compact.test.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = pi-mega-compact@0.4.14 matchedIdentity = npm:cGktbWVnYS1jb21wYWN0:0.4.14 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/extensions/mega-compact.test.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/extensions/mega-dashboard-cmds.jsView file

10import { existsSync, writeFileSync, readFileSync, unlinkSync } from "node:fs"; L11: import { spawn } from "node:child_process"; // guardrails-allow PREVENT-PI-004: spawns the optional, user-triggered localhost dashboard server only L12: /** Register the dashboard server lifecycle commands. */

High

Child Process

Package source references child process execution.

dist/extensions/mega-dashboard-cmds.jsView on unpkg · L10

10Cross-file remote execution chain: dist/extensions/mega-dashboard-cmds.js spawns dist/extensions/dashboard-server.js; helper contains network access plus dynamic code execution. L10: import { existsSync, writeFileSync, readFileSync, unlinkSync } from "node:fs"; L11: import { spawn } from "node:child_process"; // guardrails-allow PREVENT-PI-004: spawns the optional, user-triggered localhost dashboard server only L12: /** Register the dashboard server lifecycle commands. */ ... L26: try { L27: const res = await fetch(`http://localhost:${port}/api/snapshot`, { signal: AbortSignal.timeout(800) }); // guardrails-allow PREVENT-PI-004: localhost liveness probe of the dashboar... L28: if (res.ok) ... L105: function openBrowser(url) { L106: const cmd = process.platform === "darwin" ? "open" : L107: process.platform === "win32" ? "start" : ... L176: try { L177: const info = JSON.parse(readFileSync(portFile, "utf-8")); L178: // Verify the server is actually ours by probing the port before killing

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/extensions/mega-dashboard-cmds.jsView on unpkg · L10

dist/src/dedup/raptor/summarizer.jsView file

13import { estimateBlockTokens } from "../../tokens.js"; L14: import { spawnSync } from "node:child_process"; // guardrails-allow PREVENT-PI-004: localhost-only user-spawned Ollama server (BYO local model, never remote) L15: /** The local Ollama endpoint (loopback). Read lazily so tests can avoid it. */ L16: function ollamaEndpoint() { L17: const model = process.env.MEGACOMPACT_RAPTOR_MODEL; L18: if (!model) L19: return null; L20: const base = process.env.MEGACOMPACT_RAPTOR_URL ?? "http://127.0.0.1:11434"; L21: // Guard: only loopback is permitted (remote Ollama would violate PREVENT-PI-004).

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/dedup/raptor/summarizer.jsView on unpkg · L13

58try { L59: const r = await fetch(url, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ model, prompt, stream: false }) }); // guardrails-allow PREVENT... L60: const j = await r.json(); L61: process.stdout.write(JSON.stringify({ ok: r.ok, text: j.response || "" })); L62: } catch (e) { ... L65: `; L66: const res = spawnSync(process.execPath, ["-e", WORKER], { L67: encoding: "utf8",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src/dedup/raptor/summarizer.jsView on unpkg · L58

dist/extensions/mega-compact.test.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/extensions/mega-compact.test.jsView on unpkg

Findings

1 Critical5 High2 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/extensions/mega-compact.test.js

HighChild Processdist/extensions/mega-dashboard-cmds.js

HighShell

HighSame File Env Network Executiondist/src/dedup/raptor/summarizer.js

HighCommand Output Exfiltrationdist/src/dedup/raptor/summarizer.js

HighCross File Remote Execution Contextdist/extensions/mega-dashboard-cmds.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/extensions/mega-dashboard-cmds.jsView file

Lines 1-30javascript

1/**

2 * mega-dashboard-cmds.ts — the local web-dashboard slash commands.

3 *

4 * Spawns / discovers / stops the optional localhost dashboard server

5 * (extensions/dashboard-server.ts) as a detached child process. All network

6 * usage here is loopback-only and audited via // guardrails-allow PREVENT-PI-004.

7 */

8import { join, dirname, sep } from "node:path";

9import { fileURLToPath } from "node:url";

10import { existsSync, writeFileSync, readFileSync, unlinkSync } from "node:fs";

11import { spawn } from "node:child_process"; // guardrails-allow PREVENT-PI-004: spawns the optional, user-triggered localhost dashboard server only

12/** Register the dashboard server lifecycle commands. */

High

Child Process

Package source references child process execution.

dist/extensions/mega-dashboard-cmds.jsView on unpkg · L10

13export function registerDashboardCommands(pi, runtime) {

14 const portFile = join(runtime.currentStateDir, "port.pid");

15 const runnerFile = join(runtime.currentStateDir, "_dashboard-runner.mjs");

16 const launchLog = join(runtime.currentStateDir, "_dashboard-launch.log");

17 // Whether the runner must be spawned with --experimental-strip-types (true only

18 // when we fall back to the .ts source outside node_modules; false when using

19 // the shipped compiled dist/extensions/dashboard-server.js).

20 let dashboardNeedsStrip = false;

21 // The dashboard server binds 9320–9329 (TARGET_PORT..TARGET_PORT+PORT_RANGE-1

22 // in dashboard-server.js). Probe each for a live /api/snapshot so we can detect

23 // readiness even when port.pid landed in a different state dir than we poll.

24 async function findLivePort() {

25 for (let port = 9320; port <= 9329; port++) {

26 try {

28 if (res.ok)

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/extensions/mega-dashboard-cmds.jsView on unpkg · L10

29 return port;

30 }

dist/src/dedup/raptor/summarizer.jsView file

Lines 1-78javascript

1/**

2 * summarizer.ts — per-cluster summary for the RAPTOR tree (Sprint 13, Phase 6).

3 *

4 * Default: pure extractive (deterministic, zero network, zero model) reusing

5 * extractive.ts. Optional: a LOCAL Ollama model (llama3.2:3b by default) when

6 * MEGACOMPACT_RAPTOR_MODEL is set — localhost only, same PREVENT-PI-004

7 * exception class as HttpEmbedder/the dashboard. No remote API is ever called.

8 *

9 * The summarizer returns structured text + a token estimate. Faithfulness is

10 * enforced downstream by guardrails.ts — this module only produces candidates.

11 */

dist/extensions/mega-compact.test.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/extensions/mega-compact.test.jsView on unpkg