registry / pi-orchestrator-config / 4.3.11
pi-orchestrator-config@4.3.11
⚠ Under reviewOrchestrator pattern for pi: specialist subagents, enforcement, code review loop, workflow commands
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggedextensions/image-gen/image-gen.tsView file
15import * as path from "node:path";
L16: import { execFileSync, spawn } from "node:child_process";
L17: import { fileURLToPath } from "node:url";
High
Child Process
Package source references child process execution.
extensions/image-gen/image-gen.tsView on unpkg · L15extensions/orchestrator/session-validation.tsView file
200" • macOS/Linux: curl -LsSf https://astral.sh/uv/install.sh | sh\n" +
L201: " • Windows: powershell -ExecutionPolicy ByPass -c \"irm https://astral.sh/uv/install.ps1 | iex\"\n" +
L202: " • Docs: https://docs.astral.sh/uv/",
High
Shell
Package source references shell execution.
extensions/orchestrator/session-validation.tsView on unpkg · L200extensions/orchestrator/enforcement-helpers.ts
Findings
1 Critical3 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltaextensions/shared/openai-compatible-discovery.ts
HighChild Processextensions/image-gen/image-gen.ts
HighShellextensions/orchestrator/session-validation.ts
HighRuntime Package Installscripts/serve-ui.ts
MediumDynamic Requireextensions/pidiff/pidiff-ui/dist/assets/angular-ts-BiEwt-Qs.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/build-extension-uis.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvalextensions/orchestrator/enforcement-helpers.ts
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to pi-orchestrator-config@4.3.11.
See all versions of pi-orchestrator-config for other recorded verdicts.
- Review the evidence and your use of pi-orchestrator-config@4.3.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.