registry / pi-web-chat / 0.1.4

pi-web-chat@0.1.4

⚠ Under review

Web UI for the pi coding agent (OpenWebUI-style, mobile-friendly)

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 858 KB of source, external domains: base-ui.com, bit.ly, github.com, www.w3.org

Source & flagged code

4 flagged

dist/public/assets/index-CFYasWSN.jsView file

25`},h]}}const vI=e=>({IMPORTANT:{scope:"meta",begin:"!important"},BLOCK_COMMENT:e.C_BLOCK_COMMENT_MODE,HEXCOLOR:{scope:"number",begin:/#(([0-9a-fA-F]{3,4})|(([0-9a-fA-F]{2}){3,4}))\... L26: ]`,E={scope:"string",variants:[g,h,p,b]},x={scope:"number",variants:[{begin:"\\b0[bB][01]+(?:_[01]+)*\\b"},{begin:"\\b0[oO][0-7]+(?:_[0-7]+)*\\b"},{begin:"\\b0[xX][\\da-fA-F]+(?:_[... L27: https://github.com/highlightjs/highlight.js/issues/2277`),en=be,Ct=He),lt===void 0&&(lt=!0);const kn={code:Ct,language:en};Eo("before:highlight",kn);const tr=kn.result?kn.result:Mr...

High

Child Process

Package source references child process execution.

dist/public/assets/index-CFYasWSN.jsView on unpkg · L25

bin/pi-web-chat.mjsView file

Lines 1-17javascript

1#!/usr/bin/env node

2import { existsSync } from "node:fs";

3import { dirname, join } from "node:path";

4import { fileURLToPath, pathToFileURL } from "node:url";

6const root = join(dirname(fileURLToPath(import.meta.url)), "..");

7const server = join(root, "dist", "index.js");

9if (!existsSync(server)) {

10 console.error("pi-web-chat: missing dist/index.js");

11 console.error(" Dev: npm run build && npm start");

12 console.error(" Package consumers: reinstall/update the package (dist should be included).");

13 process.exit(1);

14}

16await import(pathToFileURL(server).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/pi-web-chat.mjsView on unpkg · L15

extensions/pi-web-chat.tsView file

Lines 211-251typescript

211 const probe = probeHost(host);

212 // Inline waiter keeps the package free of extra bin files.

213 const waiter = `

214const port = process.argv[1];

215const host = process.argv[2];

Source & flagged code

4 flagged · loading source

dist/public/assets/index-CFYasWSN.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code