registry / @phanthy/phanthy-codeo / 0.1.11
@phanthy/phanthy-codeo@0.1.11
⚠ Under reviewPhanthy Code coding agent for the terminal
AI Security Review
scanned 14d ago · by lpm-firewall-aiVerified text source was inspected, but required binary or non-UTF8 files remain unresolved: dist/assets/bip-bop-06-BuvNosjK-g1w3kzjq.aac. A clean verdict cannot be grounded.
Static reason
High-risk behavior combination matched malicious policy.
AI rationale
Verified text source was inspected, but required binary or non-UTF8 files remain unresolved: dist/assets/bip-bop-06-BuvNosjK-g1w3kzjq.aac. A clean verdict cannot be grounded.
Decision evidence
public snapshotAI called this Manual Review at 50.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json defines a CLI entrypoint and dependencies, with no install lifecycle script.
- The flagged eval pattern builds a function from WebAssembly emscripten constants in the tree-sitter worker.
- The bundle maps the bip-bop-06 AAC file to an audio asset; its generated chunk exports that asset path.
- The large UI bundle uses directional marks when rendering file paths, consistent with bidirectional text formatting.
- The inspected dependency sources show a terminal UI library and a platform-specific node-pty loader.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetwork
HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings
Source & flagged code
10 flaggeddist/assets/blade-DFktsHST-cwy15w3b.jsView file
1import e from"./html-derivative-BxANmYVz.js";import t from"./html-BW_6VhB7.js";import n from"./xml-BkAJuBCc.js";import a from"./sql-Dq2MiB0T.js";import r from"./javascript-WyGyM1wV...
L2: //# sourceMappingURL=blade-DFktsHST.js.map
High
Child Process
Package source references child process execution.
dist/assets/blade-DFktsHST-cwy15w3b.jsView on unpkg · L1dist/opentui-tree-sitter-worker.jsView file
2var sJ=Object.create;var{getPrototypeOf:tJ,defineProperty:HJ,getOwnPropertyNames:rJ}=Object;var eJ=Object.prototype.hasOwnProperty;function J0(J){return this[J]}var $0,X0,u0=(J,$,X...
L3: `)[0],P=R.match(j0)?.[0]??"";switch(Q._free(Y),k){case N.Syntax:throw new a(N.Syntax,{suffix:`${T}: '${R}'...`},T,0);case N.NodeName:throw new a(k,{word:P},T,P.length);case N.Field...
L4:
L5: ${D}`)}}));let Y=await Q.loadWebAssemblyModule(await X,{loadAsync:!0}),q=Object.keys(Y),K=q.find((V)=>U0.test(V)&&!V.includes("external_scanner_"));if(!K)throw console.log(`Couldn'...
L6: ${JSON.stringify(q,null,2)}`),Error("Language.load failed: no language function found in WASM file");let G=Y[K]();return new J(m,G)}},M0=(()=>{var _scriptName=import.meta.url;retur...
L7: `)}static async fetchHighlightQuery(J,$
Findings
1 Critical4 High8 Medium4 Low
CriticalTrojan Source Unicodedist/assets/index-DzPDtU7H-jnjjfvzp.js
HighChild Processdist/assets/blade-DFktsHST-cwy15w3b.js
HighSame File Env Network Executiondist/opentui-tree-sitter-worker.js
HighShips High Entropy Blobdist/assets/bip-bop-06-BuvNosjK-g1w3kzjq.aac
HighSemantic Analysis Limiteddist/assets/index-DzPDtU7H-jnjjfvzp.js
MediumDynamic Requiredist/opentui-tree-sitter-worker.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Wasm Moduledist/assets/tree-sitter-powershell-ryb2ffqs.wasm
MediumOversized Source Filedist/tui-worker.js
MediumOversized Cli Entrypoint
Affected versions and remediation
This report applies to @phanthy/phanthy-codeo@0.1.11.
See all versions of @phanthy/phanthy-codeo for other recorded verdicts.
- Review the evidence and your use of @phanthy/phanthy-codeo@0.1.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.