Loading npm security reports…

pi-worker@0.5.0: AI-agent control-surface risk | LPM Firewall

registry / pi-worker / 0.5.0

pi-worker@0.5.0

Run exact Pi models as bounded workers for coding agents.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies global skill locations for a broad inventory of AI-agent products. This creates an unconsented control-surface change before the user runs the package command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation, which runs the postinstall lifecycle hook.

Impact

A package install can add pi-worker instructions to agent skill directories in the user profile, affecting other installed coding agents.

Mechanism

Postinstall copies or links a bundled skill through a global auto-confirmed skills CLI.

Policy narrative

During npm installation, postinstall calls installSkill. The installer loads rules for 77 agent integrations, builds user-profile target paths, and invokes a local skills CLI with --global and --yes. It can therefore place the bundled pi-worker skill into broad AI-agent skill locations without an explicit setup command from the user. Although the code includes conflict checks and no text-source network exfiltration was found, those safeguards do not provide consent for this automatic cross-agent mutation.

Rationale

This package performs an unconsented postinstall mutation of a broad foreign AI-agent control surface. That behavior meets the install-control-surface blocking policy despite the absence of observed exfiltration.

Evidence

package.jsonnpm/scripts/postinstall.mjsnpm/lib/skill-install.mjsnpm/generated/skills-rules.jsonnpm/lib/native.mjsskills/pi-worker/

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node npm/scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

44"scripts": { "postinstall": "node npm/scripts/postinstall.mjs", "stage": "node npm/scripts/stage-package.mjs",

High

Suspicious Lifecycle Evidence

An npm postinstall hook automatically runs the skill installer.

package.jsonView on unpkg · L44

•scripts.postinstall = node npm/scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

npm/lib/skill-install.mjsView file

61Install-time code directly mutates a foreign AI-agent control surface: L225: const resolved = resolveTargets(rules, runtime) ?? []; L226: return targetsFromResolved([...resolved, path.join(home, ".agents", "skills")], cwd, platform); L227: } ... L229: function requiredTargetList({ rules, agentIds, runtime, cwd, platform }) { L230: const agentsById = new Map(rules.agents.map((agent) => [agent.id, agent])); L231: const resolved = agentIds.map((id) => { ... L584: L585: const canonical = path.join(home, ".agents", "skills", SKILL_NAME); L586: const states = []; ... L685: }); L686: const agentsById = new Map(rules.agents.map((agent) => [agent.id, agent])); L687: const detectedGlobalAgentIds = detected.filter((id) => agentsById.get(id)?.rule.kind !== "no-global-target"); Write operation from np

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

npm/lib/skill-install.mjsView on unpkg · L61

•matchType = normalized_sha256 matchedPackage = pi-worker@0.4.0 matchedPath = npm/lib/sk[redacted] matchedIdentity = npm:cGktd29ya2Vy:0.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

npm/lib/skill-install.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = ff5a4b1139e01a9f signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = pi-worker@0.4.0 matchedPath = npm/lib/sk[redacted] matchedIdentity = npm:cGktd29ya2Vy:0.4.0 similarity = 1.000 shingleOverlap = 8 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

npm/lib/skill-install.mjsView on unpkg

npm/native/linux-arm64/pi-workerView file

•path = npm/native/linux-arm64/pi-worker kind = native_binary sizeBytes = 3342498 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

npm/native/linux-arm64/pi-workerView on unpkg

npm/generated/skills-rules.jsonView file

2"schemaVersion": 3, "skillsVersion": "1.5.23", "agentCount": 77, "globalTargetCount": 75, "noGlobalTargetCount": 2,

High

Ai Review Evidence

The installer inventories targets for 77 agent integrations, including 75 global targets.

npm/generated/skills-rules.jsonView on unpkg · L2

Source & flagged code

8 flagged

package.jsonView file

Lines 24-61json

24 },

25 "bin": {

26 "pi-worker": "npm/bin/pi-worker.mjs"

27 },

28 "files": [

29 "npm/bin/",

30 "npm/generated/",

31 "npm/lib/",

32 "npm/native/",

33 "npm/scripts/postinstall.mjs",

34 "skills/pi-worker/",

35 "README.md",

36 "CONTRIBUTING.md",

37 "SECURITY.md",

38 "LICENSE",

39 "THIRD_PARTY_NOTICES"

40 ],

41 "dependencies": {

42 "skills": "1.5.23"

43 },

44 "scripts": {

45 "postinstall": "node npm/scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "stage": "node npm/scripts/stage-package.mjs",

High

Suspicious Lifecycle Evidence

An npm postinstall hook automatically runs the skill installer.

package.jsonView on unpkg · L44

47 "test": "node --test npm/test/*.test.mjs",

48 "check:rules": "node npm/scripts/extract-skills-rules.mjs --check npm/generated/skills-rules.json",

49 "check:notices": "go run ./tools/notices --check THIRD_PARTY_NOTICES",

50 "check:piversion": "go run ./tools/piversion --check",

51 "check:hygiene": "node npm/scripts/check-hygiene.mjs",

52 "check:gofmt": "! gofmt -l $(git ls-files '*.go') | grep .",

53 "check:govet": "go vet ./...",

54 "check:gotest": "go test -race -count=1 ./...",

55 "notices:check": "npm run check:notices",

56 "skills-rules:check": "npm run check:rules",

57 "verify": "npm run check:gofmt && npm run check:govet && npm test && npm run check:rules && npm run check:notices && npm run check:hygiene && npm run check:piversion && npm run check:gotest",

58 "prepack": "npm run check:notices && npm run check:rules && npm run check:hygiene && npm run check:piversion"

59 }

60}

61

npm/lib/skill-install.mjsView file

Lines 41-81javascript

41const MAX_RECEIPT_BYTES = 1024 * 1024;

42const CHILD_GRACE_MS = 100;

43

44const packageRootFromUrl =

npm/native/linux-arm64/pi-workerView file

•path = npm/native/linux-arm64/pi-worker kind = native_binary sizeBytes = 3342498 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

npm/native/linux-arm64/pi-workerView on unpkg

npm/generated/skills-rules.jsonView file

Lines 1-22json

1{

2 "schemaVersion": 3,

3 "skillsVersion": "1.5.23",

4 "agentCount": 77,

5 "globalTargetCount": 75,

6