registry / @emgeebee/phone_cli / 3.18.7
@emgeebee/phone_cli@3.18.7
mats useful cli scripts
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection found suspicious primitives, but they are tied to explicit CLI features: fixed bundled subcommands, documented service calls, and local config/cache handling. There is no install-time execution, arbitrary shell execution, credential sweep, hidden persistence, or concrete malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs one of the CLI bin commands or selects a command from the interactive picker.
Impact
No evidence of credential harvesting, arbitrary command execution, install-time execution, persistence, destructive behavior, or exfiltration beyond configured service API usage.
Mechanism
feature-aligned CLI API requests and fixed bundled subcommand execution
AI rationale
Static inspection found suspicious primitives, but they are tied to explicit CLI features: fixed bundled subcommands, documented service calls, and local config/cache handling. There is no install-time execution, arbitrary shell execution, credential sweep, hidden persistence, or concrete malicious behavior.
Evidence
package.jsondist/phone_cli.jsdist/i.jsdist/fuel.jsdist/octo.jsdist/cmd.jsdist/status.jsdist/cal.jsdist/ball.jsdist/r.jsdist/temp.jsdist/solar.js~/.phone_cli.json$XDG_CACHE_HOME/phone_cli~/Library/Caches/phone_cli~/.cache/phone_cli$XDG_CACHE_HOME/fuel-cli~/Library/Caches/fuel-cli~/.cache/fuel-cli.env
Network endpoints12
www.bbc.co.uk/wc-data/container/sport-data-scores-fixturesweb-cdn.api.bbci.co.uk/wc-poll-data/container/sport-data-scores-fixturesweather-broker-cdn.api.bbci.co.uk/en/forecast/aggregatedweather-broker-cdn.api.bbci.co.uk/en/maps/forecasts-observations?locations=CM2api.octopus.energy/v1www.fuel-finder.service.gov.ukapi.postcodes.io/postcodes/api.emgeebee.buzz:1880emgeebee.buzz:1880/api/wfhhuxley2.azurewebsites.net1q1v3hm1n2.execute-api.us-west-2.amazonaws.com/prod/holidayspremier-league-standings1.p.rapidapi.com/
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no install/preinstall/postinstall lifecycle hooks.
- dist/phone_cli.js only spawnSyncs bundled dist/<command>.js after command allowlist validation.
- dist/i.js launcher similarly spawnSyncs bundled command files from a fixed menu.
- dist/fuel.js reads .env/config for Fuel Finder credentials and sends them only to configured Fuel Finder OAuth endpoint during user-invoked fuel commands.
- dist/octo.js reads ~/.phone_cli.json Octopus credentials and calls https://api.octopus.energy/v1 for user-requested energy data.
- Network calls are CLI feature-aligned: BBC, Octopus, Fuel Finder, postcodes.io, emgeebee home APIs, RapidAPI weather/sports/moon endpoints.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsObfuscatedUrlStrings
Source & flagged code
5 flaggeddist/fuel.jsView file
1194var EventEmitter = require("node:events").EventEmitter;
L1195: var childProcess = require("node:child_process");
L1196: var path = require("node:path");
High
38* Constructs the CommanderError class
L39: * @param {number} exitCode suggested exit code which could be used with process.exit
L40: * @param {string} code an id string representing the error
...
L1194: var EventEmitter = require("node:events").EventEmitter;
L1195: var childProcess = require("node:child_process");
L1196: var path = require("node:path");
...
L1244: this._outputConfiguration = {
L1245: writeOut: (str) => process3.stdout.write(str),
L1246: writeErr: (str) => process3.stderr.write(str),
...
L1286: * @returns {Command[]}
L1287: * @private
L1288: */
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/fuel.jsView on unpkg · L3838Cross-file remote execution chain: dist/fuel.js spawns dist/r.js; helper contains network access plus dynamic code execution.
L38: * Constructs the CommanderError class
L39: * @param {number} exitCode suggested exit code which could be used with process.exit
L40: * @param {string} code an id string representing the error
...
L1194: var EventEmitter = require("node:events").EventEmitter;
L1195: var childProcess = require("node:child_process");
L1196: var path = require("node:path");
...
L1244: this._outputConfiguration = {
L1245: writeOut: (str) => process3.stdout.write(str),
L1246: writeErr: (str) => process3.stderr.write(str),
...
L1286: * @returns {Command[]}
L1287: * @private
L1288: */
Findings
1 Critical4 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/octo.js
HighChild Processdist/fuel.js
HighSandbox Evasion Gated Capabilitydist/fuel.js
HighCross File Remote Execution Contextdist/fuel.js
HighRuntime Package Installdist/phone_cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @emgeebee/phone_cli@3.18.7.
See all versions of @emgeebee/phone_cli for other recorded verdicts.
- Review the evidence and your use of @emgeebee/phone_cli@3.18.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.