registry / @emgeebee/phone_cli / 3.22.8
@emgeebee/phone_cli@3.22.8
mats useful cli scripts
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection found no install-time execution, persistence, exfiltration, AI-agent control-surface mutation, or untrusted code execution. Suspicious primitives are package-aligned CLI behavior and bundled dependency code.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs one of the package bin commands such as phone-cli, fuel, octo, ball, cal, w, cmd, temp, solar, or status.
Impact
Expected CLI network requests and local cache/config reads or writes only.
Mechanism
User-invoked CLI API clients with local JSON config/cache
AI rationale
Static inspection found no install-time execution, persistence, exfiltration, AI-agent control-surface mutation, or untrusted code execution. Suspicious primitives are package-aligned CLI behavior and bundled dependency code.
Evidence
package.jsonREADME.mddist/phone_cli.jsdist/fuel.jsdist/octo.jsdist/cmd.jsdist/temp.jsdist/cal.jsdist/ball.jsdist/status.jsdist/solar.jsdist/w.jsdist/cric.jsdist/bday.jsdist/r.jsdist/money.jsdist/i.js
Network endpoints11
www.bbc.co.uk/wc-data/container/sport-data-scores-fixturesweb-cdn.api.bbci.co.uk/wc-poll-data/container/sport-data-scores-fixturesweather-broker-cdn.api.bbci.co.ukapi.octopus.energy/v1www.fuel-finder.service.gov.ukapi.postcodes.io1q1v3hm1n2.execute-api.us-west-2.amazonaws.com/prodpremier-league-standings1.p.rapidapi.com/moon-phases-api-apiverve.p.rapidapi.com/v1/api.emgeebee.buzz:1880emgeebee.buzz:1880
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no preinstall/install/postinstall lifecycle hooks.
- dist/phone_cli.js only dispatches allowlisted subcommands via node spawnSync on bundled dist/*.js files.
- dist/fuel.js reads fuel config/env and caches fuel datasets; no shell execution or remote code execution found in package logic.
- dist/octo.js reads user Octopus/docs tokens from config/env for documented API calls; no credential harvesting beyond user-invoked service use.
- Writes are limited to CLI config/cache JSON under user config/cache paths, not agent control surfaces, shell startup, VCS hooks, or persistence locations.
- Network use is aligned with CLI features: BBC/weather/sport, Octopus, Fuel Finder, postcodes, RapidAPI, and package author's home/API endpoints.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsObfuscated
Source & flagged code
5 flaggeddist/fuel.jsView file
1194var EventEmitter = require("node:events").EventEmitter;
L1195: var childProcess = require("node:child_process");
L1196: var path = require("node:path");
High
38* Constructs the CommanderError class
L39: * @param {number} exitCode suggested exit code which could be used with process.exit
L40: * @param {string} code an id string representing the error
...
L1194: var EventEmitter = require("node:events").EventEmitter;
L1195: var childProcess = require("node:child_process");
L1196: var path = require("node:path");
...
L1244: this._outputConfiguration = {
L1245: writeOut: (str) => process3.stdout.write(str),
L1246: writeErr: (str) => process3.stderr.write(str),
...
L1286: * @returns {Command[]}
L1287: * @private
L1288: */
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/fuel.jsView on unpkg · L3838Cross-file remote execution chain: dist/fuel.js spawns dist/r.js; helper contains network access plus dynamic code execution.
L38: * Constructs the CommanderError class
L39: * @param {number} exitCode suggested exit code which could be used with process.exit
L40: * @param {string} code an id string representing the error
...
L1194: var EventEmitter = require("node:events").EventEmitter;
L1195: var childProcess = require("node:child_process");
L1196: var path = require("node:path");
...
L1244: this._outputConfiguration = {
L1245: writeOut: (str) => process3.stdout.write(str),
L1246: writeErr: (str) => process3.stderr.write(str),
...
L1286: * @returns {Command[]}
L1287: * @private
L1288: */
Findings
1 Critical4 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/octo.js
HighChild Processdist/fuel.js
HighSandbox Evasion Gated Capabilitydist/fuel.js
HighCross File Remote Execution Contextdist/fuel.js
HighRuntime Package Installdist/phone_cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @emgeebee/phone_cli@3.22.8.
See all versions of @emgeebee/phone_cli for other recorded verdicts.
- Review the evidence and your use of @emgeebee/phone_cli@3.22.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.