Loading npm security reports…
Run exact Pi models as bounded workers for coding agents.
LPM flags this version as an AI-agent control-surface risk. npm postinstall installs the bundled Pi Worker skill without a user command. It targets a universal agent skill path and detected third-party agent skill directories.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
npm/lib/skill-install.mjsView on unpkg · L61Installer enumerates configured agent targets plus $HOME/.agents/skills.
npm/lib/skill-install.mjsView on unpkg · L224Lifecycle child runs skills add with --global --yes and detected agents.
npm/lib/skill-install.mjsView on unpkg · L704Package ships native binary artifacts.
npm/native/linux-arm64/pi-workerView on unpkgRules define 76 agent targets, including third-party agent directories.
npm/generated/skills-rules.jsonView on unpkg · L2Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L45Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L45Package ships native binary artifacts.
npm/native/linux-arm64/pi-workerView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
npm/lib/skill-install.mjsView on unpkg · L61Installer enumerates configured agent targets plus $HOME/.agents/skills.
npm/lib/skill-install.mjsView on unpkg · L224Lifecycle child runs skills add with --global --yes and detected agents.
npm/lib/skill-install.mjsView on unpkg · L704Rules define 76 agent targets, including third-party agent directories.
npm/generated/skills-rules.jsonView on unpkg · L2