Loading npm security reports…

pi-usereq@0.58.0: AI-agent control-surface risk | LPM Firewall

registry / pi-usereq / 0.58.0

pi-usereq@0.58.0

<p align="center"> <img src="https://img.shields.io/badge/python-3.11%2B-3776AB?style=flat-square&logo=python&logoColor=white" alt="Python 3.11+"> <img src="https://img.shields.io/badge/license-GPL--3.0-491?style=flat-square" alt="License: GPL-3.0">

AI Security Review

scanned 6h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The automatic postinstall handler changes the consumer project's npm script approval policy. It approves every installed package it finds with a preinstall, install, or postinstall script.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm runs this package's postinstall lifecycle hook.

Impact

This can authorize lifecycle scripts across the consumer project, weakening npm's install-script control for subsequent installs.

Mechanism

The handler scans consumer node_modules, merges qualifying package names into allowScripts, and writes the consumer package.json.

Policy narrative

During postinstall, the package scans the host project's installed dependencies and records name-only allowScripts approvals for all packages declaring install lifecycle scripts. This silently changes the host project's install policy and can permit those scripts to run in future installs.

AI rationale

The package has an automatic postinstall hook that mutates the consumer project's broad npm install-script approval policy without user confirmation. This is an unconsented control-surface change and warrants blocking.

Evidence

package.jsonscripts/install-static-checkers.tsconsumer package.json

Decision evidence

public snapshot

AI identified this as a at 99.0% confidence with false-positive risk.

Source & flagged code

5 flagged

package.jsonView file

Lines 7-47json

7 },

8 "bugs": {

9 "url": "https://github.com/Ogekuri/PI-useReq/issues"

10 },

11 "homepage": "https://github.com/Ogekuri/PI-useReq#readme",

12 "type": "module",

13 "files": [

14 "src",

15 "scripts"

16 ],

17 "scripts": {

18 "test": "node --import tsx --test tests/**/*.test.ts",

19 "test:watch": "node --import tsx --test --watch tests/**/*.test.ts",

20 "cli": "node --import tsx ./src/cli.ts",

21 "debug:ext": "node --import tsx ./scripts/debug-extension.ts",

22 "debug:ext:inspect": "node --import tsx ./scripts/debug-extension.ts inspect",

23 "debug:ext:session": "node --import tsx ./scripts/debug-extension.ts session-start",

24 "debug:ext:command": "node --import tsx ./scripts/debug-extension.ts command",

25 "debug:ext:tool": "node --import tsx ./scripts/debug-extension.ts tool",

26 "debug:ext:sdk": "node --import tsx ./scripts/debug-extension.ts sdk-smoke",

27 "postinstall": "node --import tsx ./scripts/install-static-checkers.ts"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 },

29 "pi": {

30 "extensions": [

31 "./src/index.ts"

32 ]

33 },

34 "peerDependencies": {

35 "@earendil-works/pi-ai": "^0.80.4",

36 "@earendil-works/pi-coding-agent": "^0.87.1",

37 "@earendil-works/pi-tui": "^0.80.4",

38 "@sinclair/typebox": "^0.34.49"

39 },

40 "dependencies": {

41 "eslint": "^10.7.0",

42 "fast-glob": "^3.3.3",

43 "js-tiktoken": "^1.0.21",

44 "pyright": "^1.1.411",

45 "ruff": "^1.5.4",

46 "tsx": "^4.21.0"

47 },

scripts/lib/extension-debug-harness.tsView file

Lines 117-157typescript

117 const resolvedCwd = path.resolve(cwd ?? process.cwd());

118 if (!fs.existsSync(resolvedCwd) || !fs.statSync(resolvedCwd).

scripts/pi-usereq-debug.shView file

•path = scripts/pi-usereq-debug.sh kind = build_helper sizeBytes = 14588 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/pi-usereq-debug.shView on unpkg

src/core/pi-notify.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = pi-usereq@0.50.0 matchedIdentity = npm:cGktdXNlcmVx:0.50.0 similarity = 0.703 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/core/pi-notify.tsView on unpkg