registry / @phanthy/phanthy-codeo / 0.1.6
@phanthy/phanthy-codeo@0.1.6
⚠ Under reviewPhanthy Code coding agent for the terminal
AI Security Review
scanned 14d ago · by lpm-firewall-aiVerified text source was inspected, but required binary or non-UTF8 files remain unresolved: dist/assets/bip-bop-06-BuvNosjK-g1w3kzjq.aac. A clean verdict cannot be grounded.
Static reason
High-risk behavior combination matched malicious policy.
AI rationale
Verified text source was inspected, but required binary or non-UTF8 files remain unresolved: dist/assets/bip-bop-06-BuvNosjK-g1w3kzjq.aac. A clean verdict cannot be grounded.
Decision evidence
public snapshotAI called this Manual Review at 50.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest exposes a Bun CLI with no install lifecycle hook; its executable shim imports the bundled CLI.
- The worker builds a function from WebAssembly-provided asm-const data, an Emscripten compatibility pattern.
- The flagged directional marks surround a displayed file path; they do not change executable flow.
- The AAC asset is loaded through an audio asset module and passed to Audio.play; the offline artifact report could not identify its format.
- The inspected dependencies provide fuzzy file search, terminal UI, and platform-specific PTY support; their inspected manifests have no install scripts.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetwork
HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings
Source & flagged code
10 flaggeddist/assets/blade-DFktsHST-cwy15w3b.jsView file
1import e from"./html-derivative-BxANmYVz.js";import t from"./html-BW_6VhB7.js";import n from"./xml-BkAJuBCc.js";import a from"./sql-Dq2MiB0T.js";import r from"./javascript-WyGyM1wV...
L2: //# sourceMappingURL=blade-DFktsHST.js.map
High
Child Process
Package source references child process execution.
dist/assets/blade-DFktsHST-cwy15w3b.jsView on unpkg · L1dist/opentui-tree-sitter-worker.jsView file
2var sJ=Object.create;var{getPrototypeOf:tJ,defineProperty:HJ,getOwnPropertyNames:rJ}=Object;var eJ=Object.prototype.hasOwnProperty;function J0(J){return this[J]}var $0,X0,u0=(J,$,X...
L3: `)[0],P=R.match(j0)?.[0]??"";switch(Q._free(Y),k){case N.Syntax:throw new a(N.Syntax,{suffix:`${T}: '${R}'...`},T,0);case N.NodeName:throw new a(k,{word:P},T,P.length);case N.Field...
L4:
L5: ${D}`)}}));let Y=await Q.loadWebAssemblyModule(await X,{loadAsync:!0}),q=Object.keys(Y),K=q.find((V)=>U0.test(V)&&!V.includes("external_scanner_"));if(!K)throw console.log(`Couldn'...
L6: ${JSON.stringify(q,null,2)}`),Error("Language.load failed: no language function found in WASM file");let G=Y[K]();return new J(m,G)}},M0=(()=>{var _scriptName=import.meta.url;retur...
L7: `)}static async fetchHighlightQuery(J,$
Findings
1 Critical4 High8 Medium4 Low
CriticalTrojan Source Unicodedist/assets/index-Ch9JmY-T-qtm3vhh5.js
HighChild Processdist/assets/blade-DFktsHST-cwy15w3b.js
HighSame File Env Network Executiondist/opentui-tree-sitter-worker.js
HighShips High Entropy Blobdist/assets/bip-bop-06-BuvNosjK-g1w3kzjq.aac
HighSemantic Analysis Limiteddist/assets/index-Ch9JmY-T-qtm3vhh5.js
MediumDynamic Requiredist/opentui-tree-sitter-worker.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Wasm Moduledist/assets/tree-sitter-powershell-ryb2ffqs.wasm
MediumOversized Source Filedist/tui-worker.js
MediumOversized Cli Entrypoint
Affected versions and remediation
This report applies to @phanthy/phanthy-codeo@0.1.6.
See all versions of @phanthy/phanthy-codeo for other recorded verdicts.
- Review the evidence and your use of @phanthy/phanthy-codeo@0.1.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.