Loading npm security reports…

privateer-agent@0.6.1: Suspicious npm security report (Warn) | LPM Firewall

registry / privateer-agent / 0.6.1

privateer-agent@0.6.1

Privateer — a provider-agnostic, safe-by-default terminal coding agent with TEE/Tinfoil attestation, rebuilt on the Pi toolkit. Bring your own model across 20 providers.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 81 file(s), 569 KB of source, external domains: api.github.com, api.telegram.org, dashscope-intl.aliyuncs.com, discord.com, graph.facebook.com, helix-server-m1ac.onrender.com, inference.tinfoil.sh, openrouter.ai, privateer.pro, slack.com, www.apple.com

Source & flagged code

8 flagged

package.jsonView file

Lines 31-71json

31 "privateer": "./bin/privateer-tui"

32 },

33 "publishConfig": {

34 "access": "public"

35 },

36 "files": [

37 "bin",

38 "src",

39 "extensions",

40 "patches",

41 "README.md",

42 "LICENSE"

43 ],

44 "scripts": {

45 "start": "tsx src/main.ts",

46 "chat": "node --env-file=.env --import tsx src/cli/chat.ts",

47 "channels": "node --env-file=.env --import tsx src/channels/run.ts",

48 "dev": "tsx watch src/main.ts",

49 "typecheck": "tsc --noEmit",

50 "test": "for f in tests/*.test.ts; do node --import tsx --test \"$f\" || exit 1; done",

51 "postinstall": "patch-package --error-on-fail"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L51

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L51

52 },

53 "engines": {

54 "node": ">=22.19.0"

55 },

56 "dependencies": {

57 "@earendil-works/pi-ai": "^0.80.3",

58 "@earendil-works/pi-coding-agent": "0.80.3",

59 "@earendil-works/pi-tui": "^0.80.3",

60 "@hypabolic/pi-hypa": "^0.1.6",

61 "@juicesharp/rpiv-web-tools": "^1.20.0",

62 "@noble/ciphers": "^2.1.1",

63 "@noble/curves": "^1.9.7",

64 "@noble/hashes": "^1.7.1",

65 "patch-package": "^8.0.1",

66 "pi-mcp-adapter": "^2.11.0",

67 "pi-privacy": "^0.3.0",

68 "pi-subagents": "^0.34.0",

69 "picomatch": "^4.0.4",

70 "privateer-workflow": "^0.1.0",

71 "tsx": "^4.16.0",

bin/privateer-launch.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// Cross-platform Privateer launcher — the single source of launch logic for every

3// platform (macOS, Linux, Windows). `bin/privateer-tui` (unix) and the Windows

4// `privateer.cmd` are thin shims that just pick a Node and run THIS file.

5//

6// It boots Pi's full interactive TUI with the Privateer moat + tool packs. The moat

7// is installed as re-export SHIMS in the agent dir's extensions/, so BOTH this TUI

8// and any subagents it spawns (child processes reading the same agent dir) load the

9// identical set — including our permission gate. One source of truth via discovery

bin/privateer-daemon.mjsView file

Lines 8-31javascript

8// by the installed launchd/systemd service (`node privateer-daemon.mjs run`).

9import { register } from "tsx/esm/api";

10import { fileURLToPath } from "node:url";

11import { dirname, resolve } from "node:path";

13const

src/daemon/service.tsView file

Lines 1-29typescript

1// Install the resident daemon as a per-user OS service so it auto-starts at login

2// and survives the terminal closing — the difference between "the CLI is running"

3// and "the daemon is reachable from the app even when no CLI is". macOS → launchd

4// user agent; Linux → systemd --user unit. No root: everything lives under the

5// user's own home and login session.

6//

7// ORDERING NOTE: this module is import-safe (node builtins + our paths only, no Pi),

8// so the daemon CLI can load it without going through boot.ts.

9import { existsSync, mkdirSync, writeFileSync, rmSync, readFileSync } from

extensions/privateer-brand.tsView file

Lines 302-342typescript

302 setHeader(ctx);

303 ctx?.ui?.setStatus?.("account", accountBadge());

304 };

305

306 // Drop Pi's PERSISTED account credential (the "privateer" entry in auth.json).

307 // Pi reuses this credential on the next launch and refreshes it only when it

308 // EXPIRES — never reactively on a 401 (see the LIFECYCLE HAZARD note in

bin/privateer.cmdView file

•path = bin/privateer.cmd kind = build_helper sizeBytes = 321 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/privateer.cmdView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

Source & flagged code

8 flagged

package.jsonView file

Lines 31-71json

31 "privateer": "./bin/privateer-tui"

32 },

33 "publishConfig": {

34 "access": "public"

35 },

36 "files": [

37 "bin",

38 "src",

39 "extensions",

40 "patches",

41 "README.md",

42 "LICENSE"

43 ],

44 "scripts": {

45 "start": "tsx src/main.ts",

46 "chat": "node --env-file=.env --import tsx src/cli/chat.ts",

47 "channels": "node --env-file=.env --import tsx src/channels/run.ts",

48 "dev": "tsx watch src/main.ts",

49 "typecheck": "tsc --noEmit",

50 "test": "for f in tests/*.test.ts; do node --import tsx --test \"$f\" || exit 1; done",

51 "postinstall": "patch-package --error-on-fail"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L51

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L51

52 },

53 "engines": {

54 "node": ">=22.19.0"

55 },

56 "dependencies": {

57 "@earendil-works/pi-ai": "^0.80.3",

58 "@earendil-works/pi-coding-agent": "0.80.3",

59 "@earendil-works/pi-tui": "^0.80.3",

60 "@hypabolic/pi-hypa": "^0.1.6",

61 "@juicesharp/rpiv-web-tools": "^1.20.0",

62 "@noble/ciphers": "^2.1.1",

63 "@noble/curves": "^1.9.7",

64 "@noble/hashes": "^1.7.1",

65 "patch-package": "^8.0.1",

66 "pi-mcp-adapter": "^2.11.0",

67 "pi-privacy": "^0.3.0",

68 "pi-subagents": "^0.34.0",

69 "picomatch": "^4.0.4",

70 "privateer-workflow": "^0.1.0",

71 "tsx": "^4.16.0",

bin/privateer-launch.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// Cross-platform Privateer launcher — the single source of launch logic for every

3// platform (macOS, Linux, Windows). `bin/privateer-tui` (unix) and the Windows

4// `privateer.cmd` are thin shims that just pick a Node and run THIS file.

5//

6// It boots Pi's full interactive TUI with the Privateer moat + tool packs. The moat

7// is installed as re-export SHIMS in the agent dir's extensions/, so BOTH this TUI

8// and any subagents it spawns (child processes reading the same agent dir) load the

9// identical set — including our permission gate. One source of truth via discovery

bin/privateer-daemon.mjsView file

Lines 8-31javascript

8// by the installed launchd/systemd service (`node privateer-daemon.mjs run`).

9import { register } from "tsx/esm/api";

10import { fileURLToPath } from "node:url";

11import { dirname, resolve } from "node:path";

13const

src/daemon/service.tsView file

Lines 1-29typescript

1// Install the resident daemon as a per-user OS service so it auto-starts at login

2// and survives the terminal closing — the difference between "the CLI is running"

3// and "the daemon is reachable from the app even when no CLI is". macOS → launchd

4// user agent; Linux → systemd --user unit. No root: everything lives under the

5// user's own home and login session.

6//

7// ORDERING NOTE: this module is import-safe (node builtins + our paths only, no Pi),

8// so the daemon CLI can load it without going through boot.ts.

9import { existsSync, mkdirSync, writeFileSync, rmSync, readFileSync } from

extensions/privateer-brand.tsView file

Lines 302-342typescript

302 setHeader(ctx);

303 ctx?.ui?.setStatus?.("account", accountBadge());

304 };

305

306 // Drop Pi's PERSISTED account credential (the "privateer" entry in auth.json).

307 // Pi reuses this credential on the next launch and refreshes it only when it

308 // EXPIRES — never reactively on a 401 (see the LIFECYCLE HAZARD note in

bin/privateer.cmdView file

•path = bin/privateer.cmd kind = build_helper sizeBytes = 321 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/privateer.cmdView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code