registry / @phanthy/phanthy-codeo / 0.1.4
@phanthy/phanthy-codeo@0.1.4
⚠ Under reviewPhanthy Code coding agent for the terminal
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 25 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetwork
HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings
Oversized source lightweight scan
dist/assets/index-Ch9JmY-T-qtm3vhh5.js
Source & flagged code
17 flaggeddist/chunks/index-t105fjnv.jsView file
6patternName = generic_password
severity = medium
line = 6
matchedText = --${V}`,...Yx};
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/chunks/index-t105fjnv.jsView on unpkg · L6dist/chunks/index-aa0cz59t.jsView file
7`),f=[],m;for(let Q of Q$)if(Q.startsWith("data:"))f.push(Q.replace(/^data:\s*/,""));else if(Q.startsWith("event:"))m=Q.replace(/^event:\s*/,"");else if(Q.startsWith("id:"))W=Q.rep...
L8: `);try{M=JSON.parse(Q),r=!0}catch{M=Q}}if(r){if(N)await N(M);if(X)M=await X(M)}if($?.({data:M,event:m,id:W,retry:D}),f.length)yield M}}}finally{E.removeEventListener("abort",u),L.r...
High
Child Process
Package source references child process execution.
dist/chunks/index-aa0cz59t.jsView on unpkg · L7dist/opentui-tree-sitter-worker.jsView file
Findings
1 Critical11 High7 Medium6 Low
CriticalTrojan Source Unicodedist/assets/index-Ch9JmY-T-qtm3vhh5.js
HighChild Processdist/chunks/index-aa0cz59t.js
HighSame File Env Network Executiondist/opentui-tree-sitter-worker.js
HighCredential Redirect Persistencedist/chunks/index-yd1y3z8c.js
HighEntrypoint Foreign Package Code Overwritedist/chunks/index-h99jrdw9.js
HighCommand Output Exfiltrationdist/chunks/runtime-79gq534a.js
HighCloud Metadata Accessdist/chunks/index-5bs42qpq.js
HighRemote Agent Bridgedist/chunks/code-mode-hbhdf4zt.js
HighCross File Remote Execution Contextdist/chunks/index-zp8mp8wr.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
Affected versions and remediation
This report applies to @phanthy/phanthy-codeo@0.1.4.
See all versions of @phanthy/phanthy-codeo for other recorded verdicts.
- Review the evidence and your use of @phanthy/phanthy-codeo@0.1.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.