registry / pi-orchestrator-config / 4.3.2
pi-orchestrator-config@4.3.2
Orchestrator pattern for pi: specialist subagents, enforcement, code review loop, workflow commands
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
2 flaggedextensions/orchestrator/enforcement-helpers.tsView file
274if (hasCurlSub && (
L275: new RegExp(execPrefix + /eval(?:\s|$)/.source).test(cmdForExecCheck) ||
L276: new RegExp(execPrefix + pathPrefix + shellExec).test(cmdForExecCheck) ||
Low
Eval
Package source references a known benign dynamic code generation pattern.
extensions/orchestrator/enforcement-helpers.tsView on unpkg · L274extensions/shared/file-logger.tsView file
142if (!_cachedGetSetting) {
L143: _cachedGetSetting = require("../orchestrator/project-settings.js").getSetting;
L144: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
extensions/shared/file-logger.tsView on unpkg · L142Findings
3 Medium4 Low
MediumDynamic Requireextensions/shared/file-logger.ts
MediumNetwork
MediumEnvironment Vars
LowEvalextensions/orchestrator/enforcement-helpers.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to pi-orchestrator-config@4.3.2.
See all versions of pi-orchestrator-config for other recorded verdicts.
- Review the evidence and your use of pi-orchestrator-config@4.3.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.