@emgeebee/phone_cli@3.26.0
mats useful cli scripts
AI Security Review
scanned 3d ago · by lpm-firewall-aiNo clear malware behavior was identified, but normal octo execution can sync household energy cache data to the package backend whenever a docs token is configured, without an in-command consent prompt. Treat this undisclosed runtime data sync as suspicious telemetry and warn users.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running octo; remote cache reads occur when config.cal.token exists, and cache writes occur when local data differs or is updated.
Impact
Household energy usage and related cache history may be stored by the package’s backend without an in-command consent prompt.
Mechanism
The command reads local cache records and sends them to the docs API authenticated with config.cal.token.
AI rationale
No clear malware behavior was identified, but normal octo execution can sync household energy cache data to the package backend whenever a docs token is configured, without an in-command consent prompt. Treat this undisclosed runtime data sync as suspicious telemetry and warn users.
Evidence
dist/octo.js~/.phone_cli.json~/.cache/phone_cli/octo/gas-prices.json~/.cache/phone_cli/octo/electricity-prices.json~/.cache/phone_cli/octo/daily-totals.json
Network endpoints2
1q1v3hm1n2.execute-api.us-west-2.amazonaws.comapi.octopus.energy
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The docs API uses a token read from config.cal.token and targets the package’s API Gateway endpoint.
- When a configured token exists, cache loading can upload merged local cache data if it differs from the remote document.
- The octo command flushes its cache during normal command execution.
- The Octopus API request sends the configured Octopus token to the Octopus API.
Evidence against
- The manifest declares build and command scripts, with no install lifecycle script.
- The remote cache sync requires config.cal.token and concerns this tool’s cache data.
- Octopus credentials are sent to api.octopus.energy, their intended service.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/fuel.jsView file
1194var EventEmitter = require("node:events").EventEmitter;
L1195: var childProcess = require("node:child_process");
L1196: var path = require("node:path");
High
38* Constructs the CommanderError class
L39: * @param {number} exitCode suggested exit code which could be used with process.exit
L40: * @param {string} code an id string representing the error
...
L1194: var EventEmitter = require("node:events").EventEmitter;
L1195: var childProcess = require("node:child_process");
L1196: var path = require("node:path");
...
L1244: this._outputConfiguration = {
L1245: writeOut: (str) => process3.stdout.write(str),
L1246: writeErr: (str) => process3.stderr.write(str),
...
L1286: * @returns {Command[]}
L1287: * @private
L1288: */
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/fuel.jsView on unpkg · L3838Cross-file remote execution chain: dist/fuel.js spawns dist/r.js; helper contains network access plus dynamic code execution.
L38: * Constructs the CommanderError class
L39: * @param {number} exitCode suggested exit code which could be used with process.exit
L40: * @param {string} code an id string representing the error
...
L1194: var EventEmitter = require("node:events").EventEmitter;
L1195: var childProcess = require("node:child_process");
L1196: var path = require("node:path");
...
L1244: this._outputConfiguration = {
L1245: writeOut: (str) => process3.stdout.write(str),
L1246: writeErr: (str) => process3.stderr.write(str),
...
L1286: * @returns {Command[]}
L1287: * @private
L1288: */
Findings
1 Critical4 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/octo.js
HighChild Processdist/fuel.js
HighSandbox Evasion Gated Capabilitydist/fuel.js
HighCross File Remote Execution Contextdist/fuel.js
HighSemantic Analysis Limiteddist/ball.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @emgeebee/phone_cli@3.26.0.
See all versions of @emgeebee/phone_cli for other recorded verdicts.
- Review the evidence and your use of @emgeebee/phone_cli@3.26.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.