registry / pi-usereq / 0.38.0

pi-usereq@0.38.0

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 16 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 447 file(s), 5.12 MB of source, external domains: 127.0.0.1, accounts.google.com, ads.google.com, adservice.google.com, ai-gateway.vercel.sh, api.anthropic.com, api.cerebras.ai, api.example.com, api.fireworks.ai, api.github.com, api.groq.com, api.individual.githubcopilot.com, api.kimi.com, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.openai.com, api.pushover.net, api.x.ai, api.z.ai, apis.google.com, app.intercom.io, appleid.cdn-apple.com, arxiv.org, autopush-cloudcode-pa.sandbox.googleapis.com, bedrock-runtime.eu-central-1.amazonaws.com, bedrock-runtime.us-east-1.amazonaws.com, berufsinfomat.prod.portal.ams.at, cdn.getpinwheel.com, cdn.plaid.com, cdn.tailwindcss.com, chat.qwen.ai, chatgpt.com, claude.ai, cli.github.com, client-api.arkoselabs.com, cloud.gitlab.com, cloudcode-pa.googleapis.com, console.anthropic.com, corsproxy.io, daily-cloudcode-pa.sandbox.googleapis.com, dashscope.aliyuncs.com, developers.cloudflare.com, distro.ibiblio.org, esm.run, esm.sh, example.com, generativelanguage.googleapis.com, git-scm.com, github.com

Source & flagged code

7 flagged

pi.dev-src/pi-mono/coding-agent/examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath(import.meta.url));

50 const buildDir = join(__dirname, "doom", "build");

51 const doomJsPath = join(buildDir, "doom.js");

53 if (!existsSync(doomJsPath)) {

54 throw new Error(`WASM not found at ${doomJsPath}. Run ./doom/build.sh first`);

55 }

57 // Read WAD file

58 const wadData = readFileSync(this.wadPath);

59 const wadArray = Array.from(new Uint8Array(wadData));

61 // Load WASM module - eval to bypass jiti completely

62 const doomJsCode = readFileSync(doomJsPath, "utf-8");

63 const moduleExports: { exports: unknown } = { exports: {} };

64 const nativeRequire = createRequire(doomJsPath);

65 const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode);

66 moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

pi.dev-src/pi-mono/coding-agent/examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

67 const createDoomModule = moduleExports.exports as (config: unknown) => Promise<DoomModule>;

69 const moduleConfig = {

70 locateFile: (path: string) => {

71 if (path.endsWith(".wasm")) {

72 return join(buildDir, path);

73 }

74 return path;

75 },

76 print: () => {},

77 printErr: () => {},

78 preRun: [

79 (module: DoomModule) => {

80 // Create /doom directory and add WAD

81 module.FS_createPath("/", "doom", true, true);

82 module.FS_createDataFile("/doom", "doom1.wad", wadArray, true, false);

83 },

84 ],

tests/fixtures/fixture_javascript.jsView file

Lines 276-316javascript

276 /* Fallback on fetch failure */

277 console.error(err);

278 return { error: true, processed: false };

279 });

280}

281

282/* ── Destructuring and defaults ───────────────────────────────────────── */

283

284/**

285 * @function

tests/python_oracle_stubs/tiktoken.pyView file

•path = tests/python_oracle_stubs/tiktoken.py kind = payload_in_excluded_dir sizeBytes = 3618 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/python_oracle_stubs/tiktoken.pyView on unpkg

•path = tests/python_oracle_stubs/tiktoken.py kind = build_helper sizeBytes = 3618 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tests/python_oracle_stubs/tiktoken.pyView on unpkg

src/resources/sounds/Machine-alert-beep-sound-effect.mp3View file

•path = src/resources/sounds/Machine-alert-beep-sound-effect.mp3 kind = high_entropy_blob sizeBytes = 27585 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/resources/sounds/Machine-alert-beep-sound-effect.mp3View on unpkg

pi.dev-src/pi-mono/ai/test/google-vertex-api-key-resolution.test.tsView file

Lines 110-145typescript

110

111 const stream = streamGoogleVertex(model, context, {

112 project: "test-project",

113 location: "us-central1",

114 });

115

116 await stream.result();

117

Source & flagged code

7 flagged · loading source

pi.dev-src/pi-mono/coding-agent/examples/extensions/doom-overlay/doom-engine.tsView file

64const nativeRequire = createRequire(doomJsPath); L65: const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode); L66: moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

pi.dev-src/pi-mono/coding-agent/examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

tests/fixtures/fixture_javascript.jsView file

296/** @brief Load the Node.js filesystem module via CommonJS. */ L297: const fs = require('fs'); L298:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/fixtures/fixture_javascript.jsView on unpkg · L296

tests/python_oracle_stubs/tiktoken.pyView file

•path = tests/python_oracle_stubs/tiktoken.py kind = payload_in_excluded_dir sizeBytes = 3618 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/python_oracle_stubs/tiktoken.pyView on unpkg

•path = tests/python_oracle_stubs/tiktoken.py kind = build_helper sizeBytes = 3618 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tests/python_oracle_stubs/tiktoken.pyView on unpkg

src/resources/sounds/Machine-alert-beep-sound-effect.mp3View file

•path = src/resources/sounds/Machine-alert-beep-sound-effect.mp3 kind = high_entropy_blob sizeBytes = 27585 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/resources/sounds/Machine-alert-beep-sound-effect.mp3View on unpkg

pi.dev-src/pi-mono/ai/test/google-vertex-api-key-resolution.test.tsView file

130patternName = google_api_key severity = high line = 130 matchedText = apiKey: ...56",

High

Secret Pattern

Google API key in pi.dev-src/pi-mono/ai/test/google-vertex-api-key-resolution.test.ts

pi.dev-src/pi-mono/ai/test/google-vertex-api-key-resolution.test.tsView on unpkg · L130

138patternName = google_api_key severity = high line = 138 matchedText = apiKey: ...56",

High

Secret Pattern

Google API key in pi.dev-src/pi-mono/ai/test/google-vertex-api-key-resolution.test.ts

pi.dev-src/pi-mono/ai/test/google-vertex-api-key-resolution.test.tsView on unpkg · L138

Findings

4 High5 Medium7 Low

HighShips High Entropy Blobsrc/resources/sounds/Machine-alert-beep-sound-effect.mp3

HighPayload In Excluded Dirtests/python_oracle_stubs/tiktoken.py

HighSecret Patternpi.dev-src/pi-mono/ai/test/google-vertex-api-key-resolution.test.ts

MediumDynamic Requiretests/fixtures/fixture_javascript.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertests/python_oracle_stubs/tiktoken.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalpi.dev-src/pi-mono/coding-agent/examples/extensions/doom-overlay/doom-engine.ts

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

pi.dev-src/pi-mono/coding-agent/examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath(import.meta.url));

50 const buildDir = join(__dirname, "doom", "build");

51 const doomJsPath = join(buildDir, "doom.js");

53 if (!existsSync(doomJsPath)) {

54 throw new Error(`WASM not found at ${doomJsPath}. Run ./doom/build.sh first`);

55 }

57 // Read WAD file

58 const wadData = readFileSync(this.wadPath);

59 const wadArray = Array.from(new Uint8Array(wadData));

61 // Load WASM module - eval to bypass jiti completely

62 const doomJsCode = readFileSync(doomJsPath, "utf-8");

63 const moduleExports: { exports: unknown } = { exports: {} };

64 const nativeRequire = createRequire(doomJsPath);

65 const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode);

66 moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

pi.dev-src/pi-mono/coding-agent/examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

67 const createDoomModule = moduleExports.exports as (config: unknown) => Promise<DoomModule>;

69 const moduleConfig = {

70 locateFile: (path: string) => {

71 if (path.endsWith(".wasm")) {

72 return join(buildDir, path);

73 }

74 return path;

75 },

76 print: () => {},

77 printErr: () => {},

78 preRun: [

79 (module: DoomModule) => {

80 // Create /doom directory and add WAD

81 module.FS_createPath("/", "doom", true, true);

82 module.FS_createDataFile("/doom", "doom1.wad", wadArray, true, false);

83 },

84 ],

tests/fixtures/fixture_javascript.jsView file

Lines 276-316javascript

276 /* Fallback on fetch failure */

277 console.error(err);

278 return { error: true, processed: false };

279 });

280}

281

282/* ── Destructuring and defaults ───────────────────────────────────────── */

283

284/**

285 * @function

tests/python_oracle_stubs/tiktoken.pyView file

•path = tests/python_oracle_stubs/tiktoken.py kind = payload_in_excluded_dir sizeBytes = 3618 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/python_oracle_stubs/tiktoken.pyView on unpkg

•path = tests/python_oracle_stubs/tiktoken.py kind = build_helper sizeBytes = 3618 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tests/python_oracle_stubs/tiktoken.pyView on unpkg

src/resources/sounds/Machine-alert-beep-sound-effect.mp3View file

•path = src/resources/sounds/Machine-alert-beep-sound-effect.mp3 kind = high_entropy_blob sizeBytes = 27585 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/resources/sounds/Machine-alert-beep-sound-effect.mp3View on unpkg

pi.dev-src/pi-mono/ai/test/google-vertex-api-key-resolution.test.tsView file

Lines 110-145typescript

110

111 const stream = streamGoogleVertex(model, context, {

112 project: "test-project",

113 location: "us-central1",

114 });

115

116 await stream.result();

117