
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
Voice input, first-run onboarding, and side-channel BTW conversations for Pi
Voice input and side-channel voice workflows for Pi.
pi-listen adds:
This package is actively being upgraded toward a more polished, enterprise-grade onboarding flow.
/voice setup, /voice reconfigure, /voice doctor, /voice info, /voice test, /voice backends, and daemon controlsglobal or project)This README is intentionally conservative: it documents the package as it exists now, while also outlining the direction of the onboarding improvements.
When voice is enabled, you can record audio and transcribe it into the Pi editor.
For supported local backends, the package can keep a transcription model warm in memory to reduce cold-start latency.
You can record or type short side questions and keep them in a lightweight thread without interrupting the main task.
Install as a Pi package:
pi install npm:pi-listen
For local development, you can also install from a path:
pi install /path/to/pi-listen
If you want a one-command setup helper for a laptop, this repo now ships separate platform scripts:
scripts/setup-macos.shscripts/setup-windows.ps1bash scripts/setup-macos.sh --mode local --backend faster-whisper
API mode example:
bash scripts/setup-macos.sh --mode api --deepgram-key YOUR_KEY --persist-deepgram-key
powershell -ExecutionPolicy Bypass -File .\scripts\setup-windows.ps1 -Mode local -Backend faster-whisper
API mode example:
powershell -ExecutionPolicy Bypass -File .\scripts\setup-windows.ps1 -Mode api -DeepgramKey YOUR_KEY -PersistDeepgramKey
What the scripts handle:
python3 or Python 3.12recDEEPGRAM_API_KEYpi install npm:pi-listen when the pi command is availabletranscribe.py and daemon.pysettings.jsonWhat still stays manual:
You should not need to run /voice setup on the happy path.
If you want project-local config instead of global config, pass the script scope flag:
--scope project --project-dir /path/to/repo-Scope project -ProjectDir C:\path\to\repoOn the first interactive session after install, pi-listen now prompts to start setup.
The onboarding flow asks:
It also shows a recommendation plus suggested install/manual steps based on your machine.
When the package can detect that a local model is already present, onboarding can surface that as:
You can re-open the onboarding flow any time with:
/voice setup
or:
/voice reconfigure
Best when you want:
Current cloud backend in the package:
DEEPGRAM_API_KEY required)Best when you want:
Current local backends in the package:
faster-whispermoonshinewhisper-cppparakeetAvailability depends on what is installed on the machine.
For local paths, pi-listen now distinguishes between:
This package currently exposes backend discovery through:
/voice backends
For a fuller comparison matrix, see docs/backends.md.
The command output now includes model-aware signals where possible, such as:
Space — record to the editor when the editor is emptyCtrl+Shift+V — toggle voice recording as a fallback shortcutCtrl+Shift+B — record and send the result to the BTW side thread/voice on — enable voice for the current session/voice off — disable voice for the current session/voice info — show current voice configuration and runtime state/voice test — run a quick voice setup check/voice setup — run the onboarding/setup flow/voice reconfigure — alias for setup when you want to switch modes or models/voice doctor — inspect environment readiness and suggested next steps/voice backends — list detected backend availability/voice daemon or /voice daemon start — start the daemon/voice daemon stop — stop the daemon/voice daemon status — inspect daemon status/btw <message> — ask a side question/btw:new [message] — start a fresh BTW thread/btw:clear — dismiss and clear the BTW thread/btw:inject — inject the BTW thread into the main agent context/btw:summarize — summarize the BTW thread and inject the summaryVoice settings are stored under the voice key in Pi settings.
Depending on how you save setup, configuration can live in either:
{
"voice": {
"version": 2,
"enabled": true,
"language": "en",
"mode": "local",
"backend": "faster-whisper",
"model": "small",
"scope": "project",
"btwEnabled": true,
"onboarding": {
"completed": true,
"schemaVersion": 2,
"completedAt": "2026-03-12T00:00:00.000Z",
"lastValidatedAt": "2026-03-12T00:00:00.000Z",
"source": "setup-command"
}
}
}
If setup is deferred or still needs repair, the onboarding block can remain incomplete until validation succeeds.
Common requirements today:
python3SoX / rec for microphone recordingExamples:
brew install soxpip install faster-whisperbrew install whisper-cppDEEPGRAM_API_KEY for DeepgramA practical path is:
/voice setupinstalled, recommended, installed, or download required/voice doctor or /voice test if you want extra validationSee docs/troubleshooting.md for deeper guidance.
rec not founddocs/backends.md — backend comparison and tradeoffsdocs/troubleshooting.md — setup and runtime troubleshootingdocs/plans/2026-03-12-pi-voice-master-plan.md — implementation plan for the onboarding overhaulPlanned next improvements include:
Current local verification commands:
bunx tsc -p tsconfig.json
python3 -m py_compile daemon.py transcribe.py
MIT
FAQs
Voice input, first-run onboarding, and side-channel BTW conversations for Pi
We found that pi-listen demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.