// npm 패키지

@fleetagent/pi-coding-agent

Coding agent CLI with read, bash, edit, write tools and session management

npmjs.com tarball repo homepage

주간

138

월간

848

버전

메인테이너

라이선스

MIT

최초 publish

2026-05-23

publisher

tiith

tarball

11,979,283 B

AUTO-PUBLISHED·1개 버전 인덱싱됨·최근 publish: 2026-06-05

// exfil path

what is read → where it ships

steals

● GitLab PAT
● AI API keys
○ clipboard
○ home dir
○ system info

sends to

(no destination string extracted — payload may be dynamic / obfuscated)

evidence in excerpt

> "resolved": "https://registry.npmjs.org/@anthropic-ai/sdk/-/sdk-0.91.1.tgz",
> import { spawn } from "node:child_process";

→ view full payload

// offending code· @0.0.8· 3 files flagged

@0.0.8·2026-06-05·AUTO-PUBLISHED·publisher: tiith
heuristic 74/100
static flags 9
llm skipped
new-publisher:13dfirst-version-suspicious-publisherhas-source-repopublisher-multi-name-burst:3publisher-version-pump:6clipboard-accesschild-process-spawnreads-env-varsreads-homedirreads-system-infofunction-constructorreads-gitlab-tokensreads-ai-api-keysbase64-decode
// offending code· 3 files flagged

--- install scripts --- ### prepublishOnly npm run clean && npm run build && npm run shrinkwrap --- package/npm-shrinkwrap.json (excerpt) --- { "name": "@fleetagent/pi-coding-agent", "version": "0.0.8", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@fleetagent/pi-coding-agent", "version": "0.0.8", "license": "MIT", "dependencies": { "@fleetagent/pi-agent-core": "^0.0.8", "@fleetagent/pi-ai": "^0.0.8", "@fleetagent/pi-tui": "^0.0.8", "@silvia-odwyer/photon-node": "0.3.4", "chalk": "5.6.2", "cross-spawn": "7.0.6", "diff": "8.0.4", "glob": "13.0.6", "highlight.js": "10.7.3", "hosted-git-info": "9.0.3", "ignore": "7.0.5", "jiti": "2.7.0", "minimatch": "10.2.5", "proper-lockfile": "4.1.2", "typebox": "1.1.38", "undici": "8.3.0", "yaml": "2.9.0" }, "optionalDependencies": { "@mariozechner/clipboard": "0.3.6" }, "bin": { "pi": "dist/cli.js" }, "engines": { "node": ">=22.19.0" } }, "node_modules/@anthropic-ai/sdk": { "version": "0.91.1", "resolved": "https://registry.npmjs.org/@anthropic-ai/sdk/-/sdk-0.91.1.tgz", "integrity": "sha512-LAmu761tSN9r66ixvmciswUj/ZC+1Q4iAfpedTfSVLeswRwnY3n2Nb6Tsk+cLPP28aLOPWeMgIuTuCcMC6W/iw==", "license": "MIT", "dependencies": { "json-schema-to-ts": "^3.1.1" }, "peerDependencies": { "zod": "^3.25.0 || ^4.0.0" }, "peerDependenciesMeta": { "zod": { "optional": true } }, "bin": { "anthropic-ai-sdk": "bin/cli" } }, "node_modules/@aws-crypto/crc32": { "version": "5.2.0", "resolved": " --- package/package.json (excerpt) --- { "name": "@fleetagent/pi-coding-agent", "version": "0.0.8", "description": "Coding agent CLI with read, bash, edit, write tools and session management", "type": "module", "piConfig": { "configDir": ".pi" }, "bin": { "pi": "dist/cli.js" }, "main": "./dist/index.js", "types": "./dist/index.d.ts", "exports": { ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" }, "./hooks": { "types": "./dist/core/hooks/index.d.ts", "import": "./dist/core/hooks/index.js" } }, "files": [ "dist", "docs", "examples", "CHANGELOG.md", "npm-shrinkwrap.json" ], "scripts": { "clean": "shx rm -rf dist", "build": "tsgo -p tsconfig.build.json && shx chmod +x dist/cli.js && npm run copy-assets", "build:binary": "npm --prefix ../tui run build && npm --prefix ../ai run build && npm --prefix ../agent run build && npm run build && bun build --compile ./dist/bun/cli.js ./dist/utils/image-resize-worker.js --outfile dist/pi && npm run copy-binary-assets", "copy-assets": "shx mkdir -p dist/modes/interactive/theme && shx cp src/modes/interactive/theme/*.json dist/modes/interactive/theme/ && shx mkdir -p dist/modes/interactive/assets && shx cp src/modes/interactive/assets/*.png dist/modes/interactive/assets/ && shx mkdir -p dist/core/export-html/vendor && shx cp src/core/export-html/template.html src/core/export-html/template.css src/core/export-html/template.js dist/core/export-html/ && shx cp src/core/export-html/vendor/*.js dist/core/export-ht --- package/examples/rpc-extension-ui.ts (excerpt) --- /** * RPC Extension UI Example (TUI) * * A lightweight TUI chat client that spawns the agent in RPC mode. * Demonstrates how to build a custom UI on top of the RPC protocol, * including handling extension UI requests (select, confirm, input, editor). * * Usage: npx tsx examples/rpc-extension-ui.ts * * Slash commands: * /select - demo select dialog * /confirm - demo confirm dialog * /input - demo input dialog * /editor - demo editor dialog */ import { spawn } from "node:child_process"; import { dirname, join } from "node:path"; import * as readline from "node:readline"; import { fileURLToPath } from "node:url"; import { type Component, Container, Input, matchesKey, ProcessTerminal, SelectList, TUI } from "@fleetagent/pi-tui"; const __dirname = dirname(fileURLToPath(import.meta.url)); // ============================================================================ // ANSI helpers // ============================================================================ const GREEN = "\x1b[32m"; const YELLOW = "\x1b[33m"; const BLUE = "\x1b[34m"; const MAGENTA = "\x1b[35m"; const RED = "\x1b[31m"; const DIM = "\x1b[2m"; const BOLD = "\x1b[1m"; const RESET = "\x1b[0m"; // ============================================================================ // Extension UI request type (subset of rpc-types.ts) // ============================================================================ interface ExtensionUIRequest { type: "extension_ui_request"; id: string; method