registry / @phanthy/phanthy-codeo / 0.2.0
@phanthy/phanthy-codeo@0.2.0
⚠ Under reviewPhanthy Code coding agent for the terminal
AI Security Review
scanned 14d ago · by lpm-firewall-aiVerified text source was inspected, but required binary or non-UTF8 files remain unresolved: dist/assets/bip-bop-06-BuvNosjK-g1w3kzjq.aac. A clean verdict cannot be grounded.
Static reason
High-risk behavior combination matched malicious policy.
AI rationale
Verified text source was inspected, but required binary or non-UTF8 files remain unresolved: dist/assets/bip-bop-06-BuvNosjK-g1w3kzjq.aac. A clean verdict cannot be grounded.
Decision evidence
public snapshotAI called this Manual Review at 50.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest exposes a Bun CLI and lists runtime dependencies, with no install lifecycle script.
- The flagged worker loads Tree-sitter language data and uses eval to connect generated WebAssembly glue.
- The flagged blob is referenced by an audio module, and the UI bundle dynamically imports sound assets.
- Inspected dependency entrypoints provide terminal rendering, platform-specific pseudoterminal loading, and file-finder exports.
- The browser UI uses its current origin or a local server address.
Evidence against
- The flagged eval occurs in generated WebAssembly glue, and the worker loads parser language data.
- The flagged binary is used as an audio asset rather than being loaded as executable code.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
9 flaggeddist/opentui-tree-sitter-worker.jsView file
2var sJ=Object.create;var{getPrototypeOf:tJ,defineProperty:HJ,getOwnPropertyNames:rJ}=Object;var eJ=Object.prototype.hasOwnProperty;function J0(J){return this[J]}var $0,X0,u0=(J,$,X...
L3: `)[0],P=R.match(j0)?.[0]??"";switch(Q._free(Y),k){case N.Syntax:throw new a(N.Syntax,{suffix:`${T}: '${R}'...`},T,0);case N.NodeName:throw new a(k,{word:P},T,P.length);case N.Field...
L4:
L5: ${D}`)}}));let Y=await Q.loadWebAssemblyModule(await X,{loadAsync:!0}),q=Object.keys(Y),K=q.find((V)=>U0.test(V)&&!V.includes("external_scanner_"));if(!K)throw console.log(`Couldn'...
L6: ${JSON.stringify(q,null,2)}`),Error("Language.load failed: no language function found in WASM file");let G=Y[K]();return new J(m,G)}},M0=(()=>{var _scriptName=import.meta.url;retur...
L7: `)}static async fetchHighlightQuery(J,$
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/opentui-tree-sitter-worker.jsView on unpkg · L22var sJ=Object.create;var{getPrototypeOf:tJ,defineProperty:HJ,getOwnPropertyNames:rJ}=Object;var eJ=Object.prototype.hasOwnProperty;function J0(J){return this[J]}var $0,X0,u0=(J,$,X...
L3: `)[0],P=R.match(j0)?.[0]??"";switch(Q._free(Y),k){case N.Syntax:throw new a(N.Syntax,{suffix:`${T}: '${R}'...`},T,0);case N.NodeName:throw new a(k,{word:P},T,P.length);case N.Field...
L4:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
Findings
1 Critical3 High7 Medium5 Low
CriticalTrojan Source Unicodedist/assets/index-DwV1ZwJf-73s32e1w.js
HighSame File Env Network Executiondist/opentui-tree-sitter-worker.js
HighShips High Entropy Blobdist/assets/bip-bop-06-BuvNosjK-g1w3kzjq.aac
HighSemantic Analysis Limiteddist/assets/index-DwV1ZwJf-73s32e1w.js
MediumDynamic Requiredist/opentui-tree-sitter-worker.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduledist/assets/tree-sitter-powershell-ryb2ffqs.wasm
MediumOversized Source Filedist/tui-worker.js
MediumOversized Cli Entrypointdist/cli.js
MediumStructural Risk Force Deep Review
LowEvaldist/opentui-tree-sitter-worker.js
Affected versions and remediation
This report applies to @phanthy/phanthy-codeo@0.2.0.
See all versions of @phanthy/phanthy-codeo for other recorded verdicts.
- Review the evidence and your use of @phanthy/phanthy-codeo@0.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.