@dyyz1993/pi-coding-agent
Coding agent CLI with read, bash, edit, write tools and session management
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/modes/interactive/components/daxnuts.js | AI (source-diff): Hex-encoded RGB image data for an easter egg; not obfuscated executable code. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): 127.0.0.1 is a localhost OAuth redirect URI; not a remote exfiltration endpoint. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Used only for Windows toast notifications via powershell in examples/extensions/notify.ts. | ai | |
| semgrep | semgrep:steganography-image-eval | AI (semgrep): Reads a WAD game data file in an examples/doom-overlay extension; not a steganography attack. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Doom JS engine loader in examples/; executes local bundled game code, not remote/user input. | ai |
v0.78.3
6 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HTTP request to raw IP address — legitimate packages use domain names 36 | const BUNDLED_CLIENT_ID = "da4edff2e6ebd2bc3208611e2768bc1c1dd7be791dc5ff26ca34ca9ee44f7d4b"; 37 | const OAUTH_SCOPES = ["api"]; > 38 | const REDIRECT_URI = "http://127.0.0.1:8080/callback"; 39 | const DIRECT_ACCESS_TTL = 25 * 60 * 1000; 40 |
[Reject — re-review on republish] (prior reject: AI (semgrep): New publisher with no track record; file-read-then-eval pattern in shipped examples is a disqualifier.) Data read from image file then executed — steganography attack pattern 56 | 57 | // Read WAD file > 58 | const wadData = readFileSync(this.wadPath); 59 | const wadArray = Array.from(new Uint8Array(wadData)); 60 |
[Reject — re-review on republish] (prior reject: AI (semgrep): Dynamic code execution via new Function() on externally-read WAD data; generalizes as a risk for this package.) new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. 63 | const moduleExports: { exports: unknown } = { exports: {} }; 64 | const nativeRequire = createRequire(doomJsPath); > 65 | const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode); 66 | moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire); 67 | const createDoomModule = moduleExports.exports as (config: unknown) => Promise<DoomModule>;
child_process imported — can execute arbitrary system commands 35 | 36 | function notifyWindows(title: string, body: string): void { > 37 | const { execFile } = require("child_process"); 38 | execFile("powershell.exe", ["-NoProfile", "-Command", windowsToastScript(title, body)]); 39 | }
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.78.2
6 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HTTP request to raw IP address — legitimate packages use domain names 36 | const BUNDLED_CLIENT_ID = "da4edff2e6ebd2bc3208611e2768bc1c1dd7be791dc5ff26ca34ca9ee44f7d4b"; 37 | const OAUTH_SCOPES = ["api"]; > 38 | const REDIRECT_URI = "http://127.0.0.1:8080/callback"; 39 | const DIRECT_ACCESS_TTL = 25 * 60 * 1000; 40 |
[Reject — re-review on republish] (prior reject: AI (semgrep): New publisher with no track record; file-read-then-eval pattern in shipped examples is a disqualifier.) Data read from image file then executed — steganography attack pattern 56 | 57 | // Read WAD file > 58 | const wadData = readFileSync(this.wadPath); 59 | const wadArray = Array.from(new Uint8Array(wadData)); 60 |
[Reject — re-review on republish] (prior reject: AI (semgrep): Dynamic code execution via new Function() on externally-read WAD data; generalizes as a risk for this package.) new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. 63 | const moduleExports: { exports: unknown } = { exports: {} }; 64 | const nativeRequire = createRequire(doomJsPath); > 65 | const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode); 66 | moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire); 67 | const createDoomModule = moduleExports.exports as (config: unknown) => Promise<DoomModule>;
child_process imported — can execute arbitrary system commands 35 | 36 | function notifyWindows(title: string, body: string): void { > 37 | const { execFile } = require("child_process"); 38 | execFile("powershell.exe", ["-NoProfile", "-Command", windowsToastScript(title, body)]); 39 | }
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.