registry / @emgeebee/phone_cli / 3.18.8
@emgeebee/phone_cli@3.18.8
mats useful cli scripts
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection shows suspicious primitives are expected for a CLI aggregator: whitelisted local subcommand spawning, public/configured API calls, and user config/cache storage. No install-time execution, exfiltration, arbitrary command execution, AI-agent control-surface mutation, or destructive behavior was confirmed.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs CLI bins such as phone-cli, fuel, octo, cmd, ball, r, w, temp, solar, or status.
Impact
Expected CLI behavior; may contact configured/public service APIs and write user config/cache files.
Mechanism
Whitelisted CLI dispatch plus API clients and local cache/config reads/writes
AI rationale
Static inspection shows suspicious primitives are expected for a CLI aggregator: whitelisted local subcommand spawning, public/configured API calls, and user config/cache storage. No install-time execution, exfiltration, arbitrary command execution, AI-agent control-surface mutation, or destructive behavior was confirmed.
Evidence
package.jsondist/phone_cli.jsdist/fuel.jsdist/octo.jsdist/cmd.jsdist/ball.jsdist/r.jsdist/status.js~/.phone_cli.json$XDG_CACHE_HOME/phone_cli~/Library/Caches/phone_cli~/.cache/phone_cli$FUEL_CACHE_DIR~/.cache/fuel-cli
Network endpoints12
api.octopus.energy/v1www.fuel-finder.service.gov.ukapi.postcodes.io/postcodes/api.emgeebee.buzz:1880emgeebee.buzz:1880/api/wfhwww.bbc.co.ukweather-broker-cdn.api.bbci.co.ukweb-cdn.api.bbci.co.ukhuxley2.azurewebsites.netpremier-league-standings1.p.rapidapi.com/moon-phases-api-apiverve.p.rapidapi.com/v1/1q1v3hm1n2.execute-api.us-west-2.amazonaws.com/prod/holidays
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no install/preinstall/postinstall/prepare lifecycle hooks.
- dist/phone_cli.js only spawnSyncs whitelisted local dist subcommand scripts with process.execPath.
- dist/fuel.js network calls are fuel/postcode API clients; no shell execution in package code path found.
- dist/octo.js reads ~/.phone_cli.json credentials and calls Octopus API only for the octo command.
- dist/cmd.js posts fixed home-automation command URLs only when user runs cmd.
- No credential harvesting, persistence, destructive actions, dynamic eval, or package-manager runtime install found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsObfuscatedUrlStrings
Source & flagged code
5 flaggeddist/fuel.jsView file
1194var EventEmitter = require("node:events").EventEmitter;
L1195: var childProcess = require("node:child_process");
L1196: var path = require("node:path");
High
38* Constructs the CommanderError class
L39: * @param {number} exitCode suggested exit code which could be used with process.exit
L40: * @param {string} code an id string representing the error
...
L1194: var EventEmitter = require("node:events").EventEmitter;
L1195: var childProcess = require("node:child_process");
L1196: var path = require("node:path");
...
L1244: this._outputConfiguration = {
L1245: writeOut: (str) => process3.stdout.write(str),
L1246: writeErr: (str) => process3.stderr.write(str),
...
L1286: * @returns {Command[]}
L1287: * @private
L1288: */
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/fuel.jsView on unpkg · L3838Cross-file remote execution chain: dist/fuel.js spawns dist/r.js; helper contains network access plus dynamic code execution.
L38: * Constructs the CommanderError class
L39: * @param {number} exitCode suggested exit code which could be used with process.exit
L40: * @param {string} code an id string representing the error
...
L1194: var EventEmitter = require("node:events").EventEmitter;
L1195: var childProcess = require("node:child_process");
L1196: var path = require("node:path");
...
L1244: this._outputConfiguration = {
L1245: writeOut: (str) => process3.stdout.write(str),
L1246: writeErr: (str) => process3.stderr.write(str),
...
L1286: * @returns {Command[]}
L1287: * @private
L1288: */
Findings
1 Critical4 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/octo.js
HighChild Processdist/fuel.js
HighSandbox Evasion Gated Capabilitydist/fuel.js
HighCross File Remote Execution Contextdist/fuel.js
HighRuntime Package Installdist/phone_cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @emgeebee/phone_cli@3.18.8.
See all versions of @emgeebee/phone_cli for other recorded verdicts.
- Review the evidence and your use of @emgeebee/phone_cli@3.18.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.