registry / pi-usereq / 0.43.0

pi-usereq@0.43.0

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 450 file(s), 5.17 MB of source, external domains: 127.0.0.1, accounts.google.com, ads.google.com, adservice.google.com, ai-gateway.vercel.sh, api.anthropic.com, api.cerebras.ai, api.example.com, api.fireworks.ai, api.github.com, api.groq.com, api.individual.githubcopilot.com, api.kimi.com, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.openai.com, api.pushover.net, api.x.ai, api.z.ai, apis.google.com, app.intercom.io, appleid.cdn-apple.com, arxiv.org, autopush-cloudcode-pa.sandbox.googleapis.com, bedrock-runtime.eu-central-1.amazonaws.com, bedrock-runtime.us-east-1.amazonaws.com, berufsinfomat.prod.portal.ams.at, cdn.getpinwheel.com, cdn.plaid.com, cdn.tailwindcss.com, chat.qwen.ai, chatgpt.com, claude.ai, cli.github.com, client-api.arkoselabs.com, cloud.gitlab.com, cloudcode-pa.googleapis.com, console.anthropic.com, corsproxy.io, daily-cloudcode-pa.sandbox.googleapis.com, dashscope.aliyuncs.com, developers.cloudflare.com, distro.ibiblio.org, esm.run, esm.sh, example.com, generativelanguage.googleapis.com, git-scm.com, github.com

Source & flagged code

9 flagged

package.jsonView file

Lines 3-43json

3 "version": "0.43.0",

4 "repository": {

5 "type": "git",

6 "url": "git+https://github.com/Ogekuri/PI-useReq.git"

7 },

8 "bugs": {

9 "url": "https://github.com/Ogekuri/PI-useReq/issues"

10 },

11 "homepage": "https://github.com/Ogekuri/PI-useReq#readme",

12 "type": "module",

13 "scripts": {

14 "test": "node --import tsx --test tests/**/*.test.ts",

15 "test:watch": "node --import tsx --test --watch tests/**/*.test.ts",

16 "cli": "node --import tsx ./src/cli.ts",

17 "debug:ext": "node --import tsx ./scripts/debug-extension.ts",

18 "debug:ext:inspect": "node --import tsx ./scripts/debug-extension.ts inspect",

19 "debug:ext:session": "node --import tsx ./scripts/debug-extension.ts session-start",

20 "debug:ext:command": "node --import tsx ./scripts/debug-extension.ts command",

21 "debug:ext:tool": "node --import tsx ./scripts/debug-extension.ts tool",

22 "debug:ext:sdk": "node --import tsx ./scripts/debug-extension.ts sdk-smoke",

23 "postinstall": "node --import tsx ./scripts/install-static-checkers.ts"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 },

25 "pi": {

26 "extensions": [

27 "./src/index.ts"

28 ]

29 },

30 "peerDependencies": {

31 "@mariozechner/pi-ai": "*",

32 "@mariozechner/pi-coding-agent": "*",

33 "@mariozechner/pi-tui": "*",

34 "@sinclair/typebox": "^0.34.49"

35 },

36 "dependencies": {

37 "eslint": "^10.2.0",

38 "fast-glob": "^3.3.3",

39 "js-tiktoken": "^1.0.21",

40 "pyright": "^1.1.411",

41 "ruff": "^1.5.4",

42 "tsx": "^4.21.0"

43 },

pi.dev-src/pi-mono/coding-agent/examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath(import.meta.url));

tests/fixtures/fixture_javascript.jsView file

Lines 276-316javascript

276 /* Fallback on fetch failure */

277 console.error(err);

278 return { error: true, processed: false };

279 });

280}

281

282/* ── Destructuring and defaults ───────────────────────────────────────── */

283

284/**

285 * @function

tests/python_oracle_stubs/tiktoken.pyView file

•path = tests/python_oracle_stubs/tiktoken.py kind = payload_in_excluded_dir sizeBytes = 3618 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/python_oracle_stubs/tiktoken.pyView on unpkg

•path = tests/python_oracle_stubs/tiktoken.py kind = build_helper sizeBytes = 3618 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tests/python_oracle_stubs/tiktoken.pyView on unpkg

src/resources/sounds/Machine-alert-beep-sound-effect.mp3View file

•path = src/resources/sounds/Machine-alert-beep-sound-effect.mp3 kind = high_entropy_blob sizeBytes = 27585 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/resources/sounds/Machine-alert-beep-sound-effect.mp3View on unpkg

pi.dev-src/pi-mono/ai/test/google-vertex-api-key-resolution.test.tsView file

Lines 110-145typescript

110

111 const stream = streamGoogleVertex(model, context, {

112 project: "test-project",

113 location: "us-central1",

114 });

115

116 await stream.result();

117

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node --import tsx ./scripts/install-static-checkers.ts

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node --import tsx ./scripts/install-static-checkers.ts

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

pi.dev-src/pi-mono/coding-agent/examples/extensions/doom-overlay/doom-engine.tsView file

64const nativeRequire = createRequire(doomJsPath); L65: const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode); L66: moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

pi.dev-src/pi-mono/coding-agent/examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

tests/fixtures/fixture_javascript.jsView file

296/** @brief Load the Node.js filesystem module via CommonJS. */ L297: const fs = require('fs'); L298:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/fixtures/fixture_javascript.jsView on unpkg · L296

tests/python_oracle_stubs/tiktoken.pyView file

•path = tests/python_oracle_stubs/tiktoken.py kind = payload_in_excluded_dir sizeBytes = 3618 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/python_oracle_stubs/tiktoken.pyView on unpkg

•path = tests/python_oracle_stubs/tiktoken.py kind = build_helper sizeBytes = 3618 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tests/python_oracle_stubs/tiktoken.pyView on unpkg

src/resources/sounds/Machine-alert-beep-sound-effect.mp3View file

•path = src/resources/sounds/Machine-alert-beep-sound-effect.mp3 kind = high_entropy_blob sizeBytes = 27585 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/resources/sounds/Machine-alert-beep-sound-effect.mp3View on unpkg

pi.dev-src/pi-mono/ai/test/google-vertex-api-key-resolution.test.tsView file

130patternName = google_api_key severity = high line = 130 matchedText = apiKey: ...56",

High

Secret Pattern

Google API key in pi.dev-src/pi-mono/ai/test/google-vertex-api-key-resolution.test.ts

pi.dev-src/pi-mono/ai/test/google-vertex-api-key-resolution.test.tsView on unpkg · L130

138patternName = google_api_key severity = high line = 138 matchedText = apiKey: ...56",

High

Secret Pattern

Google API key in pi.dev-src/pi-mono/ai/test/google-vertex-api-key-resolution.test.ts

pi.dev-src/pi-mono/ai/test/google-vertex-api-key-resolution.test.tsView on unpkg · L138

Findings

5 High6 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobsrc/resources/sounds/Machine-alert-beep-sound-effect.mp3

HighPayload In Excluded Dirtests/python_oracle_stubs/tiktoken.py

HighSecret Patternpi.dev-src/pi-mono/ai/test/google-vertex-api-key-resolution.test.ts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiretests/fixtures/fixture_javascript.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertests/python_oracle_stubs/tiktoken.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalpi.dev-src/pi-mono/coding-agent/examples/extensions/doom-overlay/doom-engine.ts

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

9 flagged

package.jsonView file

Lines 3-43json

3 "version": "0.43.0",

4 "repository": {

5 "type": "git",

6 "url": "git+https://github.com/Ogekuri/PI-useReq.git"

7 },

8 "bugs": {

9 "url": "https://github.com/Ogekuri/PI-useReq/issues"

10 },

11 "homepage": "https://github.com/Ogekuri/PI-useReq#readme",

12 "type": "module",

13 "scripts": {

14 "test": "node --import tsx --test tests/**/*.test.ts",

15 "test:watch": "node --import tsx --test --watch tests/**/*.test.ts",

16 "cli": "node --import tsx ./src/cli.ts",

17 "debug:ext": "node --import tsx ./scripts/debug-extension.ts",

18 "debug:ext:inspect": "node --import tsx ./scripts/debug-extension.ts inspect",

19 "debug:ext:session": "node --import tsx ./scripts/debug-extension.ts session-start",

20 "debug:ext:command": "node --import tsx ./scripts/debug-extension.ts command",

21 "debug:ext:tool": "node --import tsx ./scripts/debug-extension.ts tool",

22 "debug:ext:sdk": "node --import tsx ./scripts/debug-extension.ts sdk-smoke",

23 "postinstall": "node --import tsx ./scripts/install-static-checkers.ts"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 },

25 "pi": {

26 "extensions": [

27 "./src/index.ts"

28 ]

29 },

30 "peerDependencies": {

31 "@mariozechner/pi-ai": "*",

32 "@mariozechner/pi-coding-agent": "*",

33 "@mariozechner/pi-tui": "*",

34 "@sinclair/typebox": "^0.34.49"

35 },

36 "dependencies": {

37 "eslint": "^10.2.0",

38 "fast-glob": "^3.3.3",

39 "js-tiktoken": "^1.0.21",

40 "pyright": "^1.1.411",

41 "ruff": "^1.5.4",

42 "tsx": "^4.21.0"

43 },

pi.dev-src/pi-mono/coding-agent/examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath(import.meta.url));

tests/fixtures/fixture_javascript.jsView file

Lines 276-316javascript

276 /* Fallback on fetch failure */

277 console.error(err);

278 return { error: true, processed: false };

279 });

280}

281

282/* ── Destructuring and defaults ───────────────────────────────────────── */

283

284/**

285 * @function

tests/python_oracle_stubs/tiktoken.pyView file

•path = tests/python_oracle_stubs/tiktoken.py kind = payload_in_excluded_dir sizeBytes = 3618 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/python_oracle_stubs/tiktoken.pyView on unpkg

•path = tests/python_oracle_stubs/tiktoken.py kind = build_helper sizeBytes = 3618 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tests/python_oracle_stubs/tiktoken.pyView on unpkg

src/resources/sounds/Machine-alert-beep-sound-effect.mp3View file

•path = src/resources/sounds/Machine-alert-beep-sound-effect.mp3 kind = high_entropy_blob sizeBytes = 27585 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/resources/sounds/Machine-alert-beep-sound-effect.mp3View on unpkg

pi.dev-src/pi-mono/ai/test/google-vertex-api-key-resolution.test.tsView file

Lines 110-145typescript

110

111 const stream = streamGoogleVertex(model, context, {

112 project: "test-project",

113 location: "us-central1",

114 });

115

116 await stream.result();

117