registry / @phanthy/phanthy-codeo / 0.2.7
@phanthy/phanthy-codeo@0.2.7
⚠ Under reviewPhanthy Code coding agent for the terminal
AI Security Review
scanned 14d ago · by lpm-firewall-aiVerified text source was inspected, but required binary or non-UTF8 files remain unresolved: dist/assets/bip-bop-06-BuvNosjK-g1w3kzjq.aac. A clean verdict cannot be grounded.
Static reason
High-risk behavior combination matched malicious policy.
AI rationale
Verified text source was inspected, but required binary or non-UTF8 files remain unresolved: dist/assets/bip-bop-06-BuvNosjK-g1w3kzjq.aac. A clean verdict cannot be grounded.
Decision evidence
public snapshotAI called this Manual Review at 50.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json declares a CLI entry point and runtime dependencies for the product.
- The worker’s eval builds Emscripten ASM constants from module exports, matching the flagged tree-sitter runtime.
- The flagged invisible characters appear in an HTML entity table as named direction and spacing entities.
- The flagged AAC file is referenced in the embedded UI’s audio asset map; its offline analysis identifies the same file and hash.
- The inspected dependency entry points identify fuzzy file search, terminal UI, and PTY functionality.
Evidence against
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
9 flaggeddist/opentui-tree-sitter-worker.jsView file
2var sJ=Object.create;var{getPrototypeOf:tJ,defineProperty:HJ,getOwnPropertyNames:rJ}=Object;var eJ=Object.prototype.hasOwnProperty;function J0(J){return this[J]}var $0,X0,u0=(J,$,X...
L3: `)[0],P=R.match(j0)?.[0]??"";switch(Q._free(Y),k){case N.Syntax:throw new a(N.Syntax,{suffix:`${T}: '${R}'...`},T,0);case N.NodeName:throw new a(k,{word:P},T,P.length);case N.Field...
L4:
L5: ${D}`)}}));let Y=await Q.loadWebAssemblyModule(await X,{loadAsync:!0}),q=Object.keys(Y),K=q.find((V)=>U0.test(V)&&!V.includes("external_scanner_"));if(!K)throw console.log(`Couldn'...
L6: ${JSON.stringify(q,null,2)}`),Error("Language.load failed: no language function found in WASM file");let G=Y[K]();return new J(m,G)}},M0=(()=>{var _scriptName=import.meta.url;retur...
L7: `)}static async fetchHighlightQuery(J,$
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/opentui-tree-sitter-worker.jsView on unpkg · L22var sJ=Object.create;var{getPrototypeOf:tJ,defineProperty:HJ,getOwnPropertyNames:rJ}=Object;var eJ=Object.prototype.hasOwnProperty;function J0(J){return this[J]}var $0,X0,u0=(J,$,X...
L3: `)[0],P=R.match(j0)?.[0]??"";switch(Q._free(Y),k){case N.Syntax:throw new a(N.Syntax,{suffix:`${T}: '${R}'...`},T,0);case N.NodeName:throw new a(k,{word:P},T,P.length);case N.Field...
L4:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
Findings
1 Critical3 High7 Medium5 Low
CriticalTrojan Source Unicodedist/assets/index-CJN8uHpE-mqfa5n8q.js
HighSame File Env Network Executiondist/opentui-tree-sitter-worker.js
HighShips High Entropy Blobdist/assets/bip-bop-06-BuvNosjK-g1w3kzjq.aac
HighSemantic Analysis Limiteddist/assets/index-CJN8uHpE-mqfa5n8q.js
MediumDynamic Requiredist/opentui-tree-sitter-worker.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduledist/assets/tree-sitter-powershell-ryb2ffqs.wasm
MediumOversized Source Filedist/tui-worker.js
MediumOversized Cli Entrypointdist/cli.js
MediumStructural Risk Force Deep Review
LowEvaldist/opentui-tree-sitter-worker.js
Affected versions and remediation
This report applies to @phanthy/phanthy-codeo@0.2.7.
See all versions of @phanthy/phanthy-codeo for other recorded verdicts.
- Review the evidence and your use of @phanthy/phanthy-codeo@0.2.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.