@phanthy/phanthy-codeo@0.2.13
Phanthy Code coding agent for the terminal
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe CLI sends runtime telemetry to the vendor by default, including account email and linkable identifiers, with an environment-variable opt-out. The behavior warrants a warning; the oversized CLI prevented the citation tool from verifying excerpts for the telemetry implementation.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Automatically when the CLI starts and emits events; a PHANTHY_CODEO_TELEMETRY=0 setting disables collection.
Impact
The vendor receives linkable usage and account metadata. The oversized CLI exceeded the citation verifier’s 16 MiB limit, so its telemetry excerpts could not be cited.
Mechanism
The CLI records events and a device ID, then posts batches with the user’s Phanthy bearer token to the service endpoint. Event data includes account email and IDs alongside session, project, request, model, provider, and runtime metadata.
AI rationale
The CLI sends runtime telemetry to the vendor by default, including account email and linkable identifiers, with an environment-variable opt-out. The behavior warrants a warning; the oversized CLI prevented the citation tool from verifying excerpts for the telemetry implementation.
Evidence
dist/cli.jstelemetry/events.jsonltelemetry/device-id
Network endpoints1
code.phanthy.com/api/event_logging/batch
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes a CLI whose entry point imports dist/cli.js.
- The CLI starts first-party telemetry automatically, stores events and a device ID, and sends batched events to https://code.phanthy.com/api/event_logging/batch. The payload can include account email and UUIDs, session, project and request IDs, model and provider, plus runtime and machine details; telemetry can be disabled with PHANTHY_CODEO_TELEMETRY=0.
- The CLI’s telemetry code filters sensitive metadata keys such as prompt, content, token, and tool output.
Evidence against
- package.json declares no lifecycle scripts, so the telemetry is runtime behavior rather than install-time activity.
- The network destination is the package’s own Phanthy service, and the events are usage telemetry rather than prompt or tool-output collection.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
Source & flagged code
9 flaggeddist/opentui-tree-sitter-worker.jsView file
2var sJ=Object.create;var{getPrototypeOf:tJ,defineProperty:HJ,getOwnPropertyNames:rJ}=Object;var eJ=Object.prototype.hasOwnProperty;function J0(J){return this[J]}var $0,X0,u0=(J,$,X...
L3: `)[0],P=R.match(j0)?.[0]??"";switch(Q._free(Y),k){case N.Syntax:throw new a(N.Syntax,{suffix:`${T}: '${R}'...`},T,0);case N.NodeName:throw new a(k,{word:P},T,P.length);case N.Field...
L4:
L5: ${D}`)}}));let Y=await Q.loadWebAssemblyModule(await X,{loadAsync:!0}),q=Object.keys(Y),K=q.find((V)=>U0.test(V)&&!V.includes("external_scanner_"));if(!K)throw console.log(`Couldn'...
L6: ${JSON.stringify(q,null,2)}`),Error("Language.load failed: no language function found in WASM file");let G=Y[K]();return new J(m,G)}},M0=(()=>{var _scriptName=import.meta.url;retur...
L7: `)}static async fetchHighlightQuery(J,$
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/opentui-tree-sitter-worker.jsView on unpkg · L22var sJ=Object.create;var{getPrototypeOf:tJ,defineProperty:HJ,getOwnPropertyNames:rJ}=Object;var eJ=Object.prototype.hasOwnProperty;function J0(J){return this[J]}var $0,X0,u0=(J,$,X...
L3: `)[0],P=R.match(j0)?.[0]??"";switch(Q._free(Y),k){case N.Syntax:throw new a(N.Syntax,{suffix:`${T}: '${R}'...`},T,0);case N.NodeName:throw new a(k,{word:P},T,P.length);case N.Field...
L4:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
Findings
1 Critical3 High7 Medium5 Low
CriticalTrojan Source Unicodedist/assets/index-DEpqNX0O-cggx92ky.js
HighSame File Env Network Executiondist/opentui-tree-sitter-worker.js
HighShips High Entropy Blobdist/assets/bip-bop-06-BuvNosjK-g1w3kzjq.aac
HighSemantic Analysis Limiteddist/assets/index-DEpqNX0O-cggx92ky.js
MediumDynamic Requiredist/opentui-tree-sitter-worker.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduledist/assets/tree-sitter-powershell-ryb2ffqs.wasm
MediumOversized Source Filedist/tui-worker.js
MediumOversized Cli Entrypointdist/cli.js
MediumStructural Risk Force Deep Review
LowEvaldist/opentui-tree-sitter-worker.js
Affected versions and remediation
This report applies to @phanthy/phanthy-codeo@0.2.13.
See all versions of @phanthy/phanthy-codeo for other recorded verdicts.
- Review the evidence and your use of @phanthy/phanthy-codeo@0.2.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.