← Home

@howaboua/pi-codex-conversion

npm Repository Homepage

Codex-oriented tool and prompt adapter for pi coding agent

50
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

howaboua

Keywords

pi-packagepipi-coding-agentextensioncodexadapterapply-patch

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:toplevel-fetch AI (semgrep): Fetches versioned host asset from project's own release infra at install time. ai
semgrep semgrep:etc-passwd-access AI (semgrep): Example port-info tool lists local users, not credential theft. ai
phantom-deps phantom-dep:proxy-from-env AI (phantom-deps): proxy-from-env is used transitively for proxy-aware HTTP config; declared intentionally, benign. ai
npm-metadata bundled-binaries AI (npm-metadata): Binaries ship with auditable Rust source (main.rs/Cargo.toml/Cargo.lock) + prepublish verify; Codex-derived native tools, not opaque backdoors. ai
semgrep semgrep:silent-process-exec AI (semgrep): Code is a cross-platform URL opener using open/xdg-open/cmd; detached spawn is expected for this pattern. ai
semgrep semgrep:silent-process-exec-var AI (semgrep): Same URL-opener code path; false positive for this package. ai
semgrep semgrep:env-spread AI (semgrep): Spreading process.env into child shell env is standard for exec session managers; not exfiltration. ai
semgrep semgrep:base64-decode AI (semgrep): Decoding base64 image data from OpenAI API response; legitimate image handling, not payload obfuscation. ai

Versions (showing 50 of 50)

Version Deps Published
2.2.23 8 / 7
2.2.22 8 / 7
2.2.21 8 / 7
2.2.19 8 / 7
2.2.18 8 / 7
2.2.16 8 / 7
2.2.15 8 / 7
2.2.14 8 / 7
2.2.12 8 / 7
2.2.11 8 / 7
2.2.10 8 / 7
2.2.8 8 / 7
2.2.7 8 / 7
2.2.6 8 / 7
2.2.5 8 / 7
2.2.3 6 / 7
2.2.2 6 / 7
2.2.1 6 / 7
2.1.7 5 / 8
1.0.31 4 / 6
1.0.30 4 / 6
1.0.29 4 / 6
1.0.28 4 / 6
1.0.27 4 / 6
1.0.26 4 / 6
1.0.25 4 / 6
1.0.24 4 / 6
1.0.23 4 / 6
1.0.21 4 / 6
1.0.20 5 / 6
1.0.19 3 / 4
1.0.18 3 / 4
1.0.17 3 / 2
1.0.16 3 / 2
1.0.15 3 / 2
1.0.14 3 / 2
1.0.13 3 / 2
1.0.12 3 / 2
1.0.11 3 / 2
1.0.10 3 / 2
1.0.9 3 / 2
1.0.8 1 / 2
1.0.7 1 / 2
1.0.6 1 / 2
1.0.5 1 / 2
1.0.4 1 / 2
1.0.3 1 / 2
1.0.2 1 / 2
1.0.1 1 / 2
1.0.0 1 / 2

v2.2.23

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.22

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.21

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.19

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.18

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.16

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.15

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.14

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.12

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.1

2 findings
HIGH etc-passwd-access: examples/custom-tools/port-info/port-info.mjs:156 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/IgorWarzocha/howaboua-pi-stuff/blob/8113f7f2b7b742040302d3ae4f45c55916b5d26c/examples/custom-tools/port-info/port-info.mjs#L156 154 | function passwdUsers() { 155 | const users = new Map(); > 156 | for (const line of readText("/etc/passwd").split("\n")) { 157 | const fields = line.split(":"); 158 | if (fields.length > 2) users.set(Number(fields[2]), fields[0]);

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.7

2 findings
HIGH Bundled binary files (30) npm-metadata

[Reject — re-review on republish] (prior reject: AI (npm-metadata): Package ships opaque platform binaries with no auditable build chain; generalizes to all versions shipping these artifacts.) Package contains compiled binaries that could be backdoors: • src/tools/apply-patch/bin/darwin-arm64/apply_patch • src/tools/apply-patch/bin/darwin-x64/apply_patch • src/tools/apply-patch/bin/linux-arm64/apply_patch • src/tools/apply-patch/bin/linux-x64/apply_patch • src/tools/exec/bin/darwin-arm64/exec_bridge • src/tools/exec/bin/darwin-x64/exec_bridge • src/tools/exec/bin/linux-arm64/exec_bridge • src/tools/exec/bin/linux-x64/exec_bridge • src/tools/imagegen/bin/darwin-arm64/imagegen • src/tools/imagegen/bin/darwin-x64/imagegen ... and 20 more

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.