registry / pi-messenger-swarm / 0.25.22

pi-messenger-swarm@0.25.22

Swarm-first multi-agent messaging and task orchestration extension for Pi

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 162 file(s), 882 KB of source, external domains: 127.0.0.1

Source & flagged code

5 flagged

package.jsonView file

Lines 72-94json

72 "pi": {

73 "extensions": [

74 "./dist/index.js"

75 ],

76 "skills": [

77 "./skills"

78 ]

79 },

80 "overrides": {

81 "brace-expansion": "5.0.6"

82 },

83 "scripts": {

84 "build": "tsc -p tsconfig.build.json",

85 "test": "vitest run",

86 "test:watch": "vitest",

87 "test:coverage": "vitest run --coverage",

88 "typecheck": "tsc --noEmit",

89 "lint:dead": "knip --no-gitignore",

90 "release": "standard-version",

91 "release:dry-run": "standard-version --dry-run",

92 "postinstall": "simple-git-hooks 2>/dev/null || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L92

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L92

93 }

94}

swarm/spawn.tsView file

Lines 1-25typescript

1import * as fs from 'node:fs';

2import * as path from 'node:path';

3import { tmpdir } from 'node:os';

4import { fileURLToPath } from 'node:url';

5import { randomUUID }

dist/harness/cli.jsView file

Lines 27-67javascript

27 * pi-messenger-swarm release

28 * pi-messenger-swarm set-status "debugging auth"

29 * pi-messenger-swarm rename NewName

30 * pi-messenger-swarm spawn --role Researcher "Analyze the protocol"

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = simple-git-hooks 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = simple-git-hooks 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

swarm/spawn.tsView file

5import { randomUUID } from 'node:crypto'; L6: import { spawn, type ChildProcess } from 'node:child_process'; L7: import { getAgentDir } from '@earendil-works/pi-coding-agent';

High

Child Process

Package source references child process execution.

swarm/spawn.tsView on unpkg · L5

dist/harness/cli.jsView file

116* When the CLI runs inside a pi bash session, the ancestry looks like: L117: * zsh → pi (PID N) → bash -c "pi-messenger-swarm ..." → node (CLI) L118: *

High

Shell

Package source references shell execution.

dist/harness/cli.jsView on unpkg · L116

47*/ L48: import { execSync, spawn as spawnChild } from 'node:child_process'; L49: import * as fs from 'node:fs'; ... L51: import { fileURLToPath } from 'node:url'; L52: import * as http from 'node:http'; L53: const __filename = fileURLToPath(import.meta.url); L54: const __dirname = path.dirname(__filename); L55: const PORT = Number(process.env.PI_MESSENGER_PORT ?? 9877); L56: const HOST = '127.0.0.1';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/harness/cli.jsView on unpkg · L47

Findings

4 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processswarm/spawn.ts

HighShelldist/harness/cli.js

HighSame File Env Network Executiondist/harness/cli.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

package.jsonView file

Lines 72-94json

72 "pi": {

73 "extensions": [

74 "./dist/index.js"

75 ],

76 "skills": [

77 "./skills"

78 ]

79 },

80 "overrides": {

81 "brace-expansion": "5.0.6"

82 },

83 "scripts": {

84 "build": "tsc -p tsconfig.build.json",

85 "test": "vitest run",

86 "test:watch": "vitest",

87 "test:coverage": "vitest run --coverage",

88 "typecheck": "tsc --noEmit",

89 "lint:dead": "knip --no-gitignore",

90 "release": "standard-version",

91 "release:dry-run": "standard-version --dry-run",

92 "postinstall": "simple-git-hooks 2>/dev/null || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L92

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L92

93 }

94}

swarm/spawn.tsView file

Lines 1-25typescript

1import * as fs from 'node:fs';

2import * as path from 'node:path';

3import { tmpdir } from 'node:os';

4import { fileURLToPath } from 'node:url';

5import { randomUUID }

dist/harness/cli.jsView file

Lines 27-67javascript

27 * pi-messenger-swarm release

28 * pi-messenger-swarm set-status "debugging auth"

29 * pi-messenger-swarm rename NewName

30 * pi-messenger-swarm spawn --role Researcher "Analyze the protocol"

Lines 96-136javascript

96 timeout: 30_000,

97 }, (res) => {

98 const chunks = [];

99 res.on('data', (c) => chunks.push(c));

100 res.on('end', () => {

101 resolve({ status: res.statusCode ?? 0, body: Buffer.concat(chunks).toString('utf-8') });

102 });

103 });

104 req.on('error', (err) => resolve({ status: 0, body: err.message }));

105 req.on('timeout', () => {

106 req.destroy();

107 resolve({ status: 0, body: 'timeout' });

108 });

109 req.write(data);

110 req.end();

111 });

112}

113/**

114 * Walk the process tree to find the parent "pi" process PID.

115 *

116 * When the CLI runs inside a pi bash session, the ancestry looks like:

117 * zsh → pi (PID N) → bash -c "pi-messenger-swarm ..." → node (CLI)

118 *

High

Shell

Package source references shell execution.

dist/harness/cli.jsView on unpkg · L116

119 * The wrapper script (`exec node ...`) replaces bash, so process.ppid

120 * is typically the pi PID directly. As a fallback, we walk up a few

121 * levels using `ps` to find a process named "pi".

122 *

123 * Returns undefined when not running inside pi (human terminal, CI, etc.).

124 */

125function findCallerPid() {

126 try {

127 // Fast path: direct parent is pi (wrapper replaces bash via exec)

128 const ppid = process.ppid;

129 const cmd = execSync(`ps -o comm= -p ${ppid}`, { encoding: 'utf-8', timeout: 1000 }).trim();

130 if (cmd === 'pi')

131 return ppid;

132 // Walk up a few more levels

133 let pid = ppid;

134 for (let i = 0; i < 5; i++) {

135 const ppidStr = execSync(`ps -o ppid= -p ${pid}`, {

136 encoding: 'utf-8',