registry / pi-orchestrator-config / 4.24.2
pi-orchestrator-config@4.24.2
⚠ Under reviewOrchestrator pattern for pi: specialist subagents, enforcement, code review loop, workflow commands
Static Scan Results
scanned 40m ago · by rust-scannerStatic analysis completed at 97.0% confidence. No malicious behavior was detected; 21 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
14 flaggedextensions/image-gen/image-gen.tsView file
15import * as path from "node:path";
L16: import { execFileSync, spawn } from "node:child_process";
L17: import { fileURLToPath } from "node:url";
High
Child Process
Package source references child process execution.
extensions/image-gen/image-gen.tsView on unpkg · L15•matchType = normalized_sha256
matchedPackage = pi-orchestrator-config@4.20.0
matchedPath = extensions/image-gen/image-gen.ts
matchedIdentity = npm:cGktb3JjaGVzdHJhdG9yLWNvbmZpZw:4.20.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
extensions/image-gen/image-gen.tsView on unpkgextensions/orchestrator/git-helpers.tsView file
Findings
1 Critical11 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltaextensions/orchestrator/subagent-tool.ts
HighChild Processextensions/image-gen/image-gen.ts
HighShellextensions/orchestrator/git-helpers.ts
HighRuntime Package Installscripts/serve-ui.ts
HighSemantic Analysis Limitedextensions/image-gen/image-gen.ts#virtual:normalized:round1
HighKnown Malware Source Similarityextensions/image-gen/image-gen.ts
HighKnown Malware Source Similarityextensions/orchestrator/git-helpers.ts
HighKnown Malware Source Similarityextensions/orchestrator/session-validation.ts
HighKnown Malware Source Similarityextensions/orchestrator/settings-source.ts
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to pi-orchestrator-config@4.24.2.
See all versions of pi-orchestrator-config for other recorded verdicts.
- Review the evidence and your use of pi-orchestrator-config@4.24.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.