
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@gigachain/pi-gigachat
Advanced tools
@gigachain/pi-gigachatGigaChat as a standalone pi-coding-agent extension package.
gigachat provider registration for piGigaChat-2 (Lite), GigaChat-2-Pro, and GigaChat-2-Max/login gigachat onboarding with stored credential refreshclient.stream(...) parser pathsrc/ and published build artifacts in dist/pi install npm:@gigachain/pi-gigachat
Try it without installing:
pi -e npm:@gigachain/pi-gigachat
Or load the local checkout directly after building once:
npm install
pi -e /absolute/path/to/pi-gigachat
After loading the package, select a GigaChat model with /model or start by logging in:
/login gigachat
The onboarding flow asks for:
personal or businessbasic or tokenBecause the current public pi OAuth prompt API only supports text prompts, the onboarding uses text input with defaults instead of picker widgets.
After installing and authenticating:
pi -p --provider gigachat --model GigaChat-2-Pro "Say hello in one short sentence."
For a tool-use smoke test:
pi -p --provider gigachat --model GigaChat-2-Pro "Read package.json and reply with only the package name."
Recommended:
export GIGACHAT_CREDENTIALS=...
export GIGACHAT_SCOPE=GIGACHAT_API_PERS
Also supported:
export GIGACHAT_ACCESS_TOKEN=...
Or:
export GIGACHAT_USER=...
export GIGACHAT_PASSWORD=...
Optional:
export GIGACHAT_BASE_URL=https://gigachat.devices.sberbank.ru/api/v1
gigachat/GigaChat-2gigachat/GigaChat-2-Progigachat/GigaChat-2-MaxCurrent metadata is aligned with the public GigaChat model docs as of March 23, 2026:
GigaChat-2 is shown as GigaChat 2 LiteGigaChat-2-Pro and GigaChat-2-Max are marked as text-and-image capable in pipi model metadata only supports text and image input flags today, so GigaChat audio-input support is not represented separately even though the upstream Pro and Max models support it.
gigachat SDK for auth and request configuration.client.stream(...) path, because tool-call responses can arrive split across transport chunks and break the SDK parser.Before the first publish:
github.com/ai-forever/pi-gigachat or update the repository URLs in package.json.npm install.npm run check.npm publish --dry-run.npm publish --access public.npm install
npm run build
npm run check
FAQs
GigaChat provider extension for pi-coding-agent
The npm package @gigachain/pi-gigachat receives a total of 21 weekly downloads. As such, @gigachain/pi-gigachat popularity was classified as not popular.
We found that @gigachain/pi-gigachat demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.