npm package report

Is @mariozechner/pi-coding-agent safe?

2 known vulnerabilities, worst severity LOW.

cvss

2.2

how bad it is if exploited, out of 10

epss

0.10%

chance of exploitation in the next 30 days

xyz score

1.9

CyberXYZ composite, out of 10

fig. 01 — GHSA-r95r-rj6r-c39x, the advisory selected below

// advisories

GHSA-r95r-rj6r-c39x

LOWCVE-2026-54327

Pi stored API keys and OAuth credentials in auth.json. A race condition in the file write path could briefly create or rewrite this file with permissions derived from the process umask before tightening the file to owner-only permissions.

Affected: >= 0.28.0, <= 0.73.1, >=0.74.0, <0.78.1
Fixed in: not stated
Weakness: CWE-367
Published: 2026-06-17
Source: github

GHSA NVD MITRE reference reference reference

// dependencies

16 direct, 10 carrying known advisories, worst HIGH

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 03:28 UTC. The most recent advisory here was published 2026-06-17. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is @mariozechner/pi-coding-agent safe? npm package security report | CyberXYZ