registry / @phi-code-admin/phi-code / 0.87.0

@phi-code-admin/phi-code@0.87.0

Coding agent CLI with persistent memory, sub-agents, intelligent routing, and orchestration

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 290 file(s), 2.87 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.groq.com, api.openai.com, api.search.brave.com, claude.ai, cli.github.com, cloud.gitlab.com, coding-intl.dashscope.aliyuncs.com, console.anthropic.com, distro.ibiblio.org, generativelanguage.googleapis.com, git-scm.com, github.com, gitlab.com, html.duckduckgo.com, mariozechner.at, mistral.ai, opencode.ai, openrouter.ai, pi.dev, registry.npmjs.org, www.alibabacloud.com, www.google.com

Source & flagged code

7 flagged

package.jsonView file

Lines 28-68json

28 "examples",

29 "skills",

30 "agents",

31 "extensions",

32 "config",

33 "README.md",

34 "LICENSE",

35 "CHANGELOG.md",

36 "scripts"

37 ],

38 "scripts": {

39 "clean": "shx rm -rf dist",

40 "dev": "tsgo -p tsconfig.build.json --watch --preserveWatchOutput",

41 "build": "tsgo -p tsconfig.build.json && shx chmod +x dist/cli.js && npm run copy-assets",

42 "check:ext": "tsgo -p tsconfig.ext.json --noEmit",

43 "build:binary": "npm --prefix ../tui run build && npm --prefix ../ai run build && npm --prefix ../agent run build && npm run build && bun build --compile --external koffi ./dist/bun/cli.js --outfile dist/pi && npm run copy-binary-assets",

44 "copy-assets": "shx mkdir -p dist/modes/interactive/theme dist/core/export-html/vendor dist/core && shx cp src/modes/interactive/theme/*.json dist/modes/interactive/theme/ && shx cp src/core/default-models.json dist/core/ && shx cp src/core/export-html/template.html src/core/export-html/template.css src/core/export-html/template.js dist/core/export-html/ && shx cp src/core/export-html/vendor/*.js dist/core/export-html/vendor/",

45 "copy-binary-assets": "shx cp package.json dist/ && shx cp README.md dist/ && shx cp CHANGELOG.md dist/ && shx mkdir -p dist/theme && shx cp src/modes/interactive/theme/*.json dist/theme/ && shx mkdir -p dist/assets && shx cp -r src/modes/interactive/assets dist/ 2>/dev/null || true && shx mkdir -p dist/export-html/vendor && shx cp src/core/export-html/template.html dist/export-html/ && shx cp src/core/export-html/vendor/*.js dist/export-html/vendor/ && shx cp -r docs dist/ && shx cp -r examples dist/ && shx cp ../../node_modules/@silvia-odwyer/photon-node/photon_rs_bg.wasm dist/",

46 "test": "vitest --run",

47 "prepublishOnly": "npm run clean && npm run build",

48 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L48

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L48

49 },

50 "dependencies": {

51 "@mariozechner/jiti": "^2.6.5",

52 "@modelcontextprotocol/sdk": "^1.29.0",

53 "@phi-code-admin/browser": "^1.0.4",

54 "@silvia-odwyer/photon-node": "^0.3.4",

55 "chalk": "^5.5.0",

56 "cli-highlight": "^2.1.11",

57 "diff": "^8.0.2",

58 "extract-zip": "^2.0.1",

59 "file-type": "^21.1.1",

60 "glob": "^13.0.1",

61 "hosted-git-info": "^9.0.2",

62 "ignore": "^7.0.5",

63 "marked": "^15.0.12",

64 "minimatch": "^10.2.3",

65 "phi-code-agent": "^0.74.0",

66 "phi-code-ai": "^0.74.0",

67 "phi-code-tui": "^0.74.0",

68 "proper-lockfile": "^4.1.2",

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath(import.meta.url));

50 const buildDir

dist/core/extensions/loader.jsView file

Lines 30-70javascript

30 // typebox (new upstream name)

31 typebox: _bundledTypebox,

32 "typebox/compile": _bundledTypeboxCompile,

33 "typebox/value": _bundledTypeboxValue,

34 "@sinclair/typebox": _bundledTypebox,

35 "@sinclair/typebox/compile": _bundledTypeboxCompile,

36 "@sinclair/typebox/value": _bundledTypeboxValue,

37 // phi-code packages

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

extensions/phi/browser.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @phi-code-admin/phi-code@0.86.0 matchedIdentity = npm:[redacted]:0.86.0 similarity = 0.875 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

extensions/phi/browser.tsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

examples/extensions/doom-overlay/doom-engine.tsView file

64const nativeRequire = createRequire(doomJsPath); L65: const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode); L66: moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

dist/core/extensions/loader.jsView file

50}; L51: const require = createRequire(import.meta.url); L52: /**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/extensions/loader.jsView on unpkg · L50

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

extensions/phi/browser.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

extensions/phi/browser.tsView on unpkg

Findings

2 High7 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltaextensions/phi/browser.ts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/core/extensions/loader.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Moduleexamples/extensions/doom-overlay/doom/build/doom.wasm

MediumShips Build Helperexamples/extensions/doom-overlay/doom/build.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalexamples/extensions/doom-overlay/doom-engine.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

package.jsonView file

Lines 28-68json

28 "examples",

29 "skills",

30 "agents",

31 "extensions",

32 "config",

33 "README.md",

34 "LICENSE",

35 "CHANGELOG.md",

36 "scripts"

37 ],

38 "scripts": {

39 "clean": "shx rm -rf dist",

40 "dev": "tsgo -p tsconfig.build.json --watch --preserveWatchOutput",

41 "build": "tsgo -p tsconfig.build.json && shx chmod +x dist/cli.js && npm run copy-assets",

42 "check:ext": "tsgo -p tsconfig.ext.json --noEmit",

46 "test": "vitest --run",

47 "prepublishOnly": "npm run clean && npm run build",

48 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L48

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L48

49 },

50 "dependencies": {

51 "@mariozechner/jiti": "^2.6.5",

52 "@modelcontextprotocol/sdk": "^1.29.0",

53 "@phi-code-admin/browser": "^1.0.4",

54 "@silvia-odwyer/photon-node": "^0.3.4",

55 "chalk": "^5.5.0",

56 "cli-highlight": "^2.1.11",

57 "diff": "^8.0.2",

58 "extract-zip": "^2.0.1",

59 "file-type": "^21.1.1",

60 "glob": "^13.0.1",

61 "hosted-git-info": "^9.0.2",

62 "ignore": "^7.0.5",

63 "marked": "^15.0.12",

64 "minimatch": "^10.2.3",

65 "phi-code-agent": "^0.74.0",

66 "phi-code-ai": "^0.74.0",

67 "phi-code-tui": "^0.74.0",

68 "proper-lockfile": "^4.1.2",

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath(import.meta.url));

50 const buildDir

dist/core/extensions/loader.jsView file

Lines 30-70javascript

30 // typebox (new upstream name)

31 typebox: _bundledTypebox,

32 "typebox/compile": _bundledTypeboxCompile,

33 "typebox/value": _bundledTypeboxValue,

34 "@sinclair/typebox": _bundledTypebox,

35 "@sinclair/typebox/compile": _bundledTypeboxCompile,

36 "@sinclair/typebox/value": _bundledTypeboxValue,

37 // phi-code packages

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

extensions/phi/browser.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

extensions/phi/browser.tsView on unpkg