pi-orchestrator-config@4.20.0
Orchestrator pattern for pi: specialist subagents, enforcement, code review loop, workflow commands
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe extension starts recurring and shutdown-triggered model work by default, passing session context to a background worker that scans prior sessions and writes project memory. Because this can use the configured provider’s quota or credits without a per-run request, treat it as malicious default autonomous resource use.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Interactive session start schedules recurring runs; session quit can trigger a run as well.
Impact
Session content is processed and persisted without the user requesting each run, with potential unrequested model usage and charges.
Mechanism
The extension launches an asynchronous worker with the session file and instructions to scan prior sessions, extract memories, and write project memory. These model calls can consume the user’s configured provider quota or credits.
Attack narrative
Dreaming starts enabled and is activated on interactive session start; it also runs on session quit. The extension launches a fire-and-forget worker that receives session-file context and is instructed to process prior sessions and update project memory. This can cause unrequested model-provider usage and process session contents without a per-run request. A `/dream-auto off` command exists, but users must opt out.
AI rationale
The extension starts recurring and shutdown-triggered model work by default, passing session context to a background worker that scans prior sessions and writes project memory. Because this can use the configured provider’s quota or credits without a per-run request, treat it as malicious default autonomous resource use.
Evidence
extensions/orchestrator/dreaming.tsProject session files under the pi sessions directoryProject memory topic files under getProjectMemoryDir(cwd)Project .pi/skills/<name>/SKILL.md
Decision evidence
public snapshotAI called this Malicious at 86.0% confidence as Malware with low false-positive risk.
Evidence for block
- Dreaming is enabled by default; an interactive session starts its timer, and quitting can trigger a dream.
- The background worker receives the session file and is instructed to process earlier sessions and update project memory.
- The worker is spawned fire-and-forget, so the user need not request each model run.
Evidence against
- The behavior is presented as automatic memory consolidation, with a `/dream-auto` command to disable it.
- Image generation is a separate explicit tool that sends its prompt and API key to Google’s Gemini endpoint.
- The manifest’s only lifecycle-adjacent script is `prepack`, which builds the package’s UI assets.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
7 flaggedextensions/image-gen/image-gen.tsView file
15import * as path from "node:path";
L16: import { execFileSync, spawn } from "node:child_process";
L17: import { fileURLToPath } from "node:url";
High
Child Process
Package source references child process execution.
extensions/image-gen/image-gen.tsView on unpkg · L15extensions/orchestrator/git-helpers.tsView file
440*
L441: * Quoted text is not automatically inert — `bash -c 'git add x'`,
L442: * `eval '...'` and `"$(git add x)"` all execute — and a heredoc body is inert
High
Shell
Package source references shell execution.
extensions/orchestrator/git-helpers.tsView on unpkg · L440extensions/acpx-provider/load-runtime.tsView file
Findings
1 Critical4 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltaextensions/orchestrator/dreaming.ts
HighChild Processextensions/image-gen/image-gen.ts
HighShellextensions/orchestrator/git-helpers.ts
HighRuntime Package Installscripts/serve-ui.ts
HighSemantic Analysis Limitedextensions/image-gen/image-gen.ts#virtual:normalized:round1
MediumDynamic Requireextensions/acpx-provider/load-runtime.ts
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/build-extension-uis.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to pi-orchestrator-config@4.20.0.
See all versions of pi-orchestrator-config for other recorded verdicts.
- Avoid installing pi-orchestrator-config@4.20.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.