registry / AI-agent control-surface risk / psypi
psypi
A standalone, evidence-grounded social-science research agent — a conversation-driven agent that bundles the Pi runtime with psypi's research contracts, evidence gates, and workflows
This report shows the evidence for psypi@0.3.2. 1 of 2 known versions is blocked or flagged. The newest version, 0.4.1, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has a concrete unconsented postinstall chain that rewrites a foreign AI-agent dependency. That meets the install-control-surface block boundary.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall during psypi installation
Impact
Changes the installed Pi agent control/runtime surface without explicit user approval.
Mechanism
postinstall patches a foreign AI-agent package
Policy narrative
On installation, npm invokes scripts/rebrand-pi.mjs. It resolves @earendil-works/pi-coding-agent, modifies that package's package.json, and rewrites its interactive-mode JavaScript. This is an unconsented install-time mutation of a foreign AI-agent runtime, even though the observed edits are branding-oriented and no exfiltration was found.
AI rationale
The package has a concrete unconsented postinstall chain that rewrites a foreign AI-agent dependency. That meets the install-control-surface block boundary.
Evidence
package.jsonscripts/rebrand-pi.mjs@earendil-works/pi-coding-agent/package.json@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- postinstall automatically runs the rebranding script.
- The postinstall script resolves and rewrites the bundled Pi coding-agent package.
- It also patches Pi's interactive-mode source without user confirmation.
Evidence against
- The lifecycle script imports only local filesystem/path/URL modules; no exfiltration endpoint is present.
- Observed mutations are branding and piConfig changes, not credential harvesting or payload download.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/rebrand-pi.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/src/setup.jsView file
160const entry = fileURLToPath(import.meta.resolve("@earendil-works/pi-coding-agent"));
L161: const { AuthStorage } = await import(pathToFileURL(join(dirname(entry), "core", "auth-storage.js")).href);
L162: const auth = AuthStorage.create(join(agentDir, "auth.json"));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/src/setup.jsView on unpkg · L160scripts/rebrand-pi.mjsView file
272async function main() {
const entry = import.meta.resolve("@earendil-works/pi-coding-agent");
const pkgDir = dirname(dirname(fileURLToPath(entry)));
const pkgPath = join(pkgDir, "package.json");
const modePath = join(pkgDir, "dist", "modes", "interactive", "interactive-mode.js");
const pkgResult = await patchPackageJson(pkgPath);
const applied = await applyModePatches(modePath);
Findings
2 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighAi Review Evidencescripts/rebrand-pi.mjs
MediumDynamic Requiredist/src/setup.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to psypi@0.3.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing psypi@0.3.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.