@phi-code-admin/phi-code@0.98.2: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@phi-code-admin/phi-code@0.98.2: Suspicious npm security report | LPM Firewall

Source & flagged code

6 flagged

package.jsonView file

Lines 32-72json

32 "skills",

33 "agents",

34 "extensions",

35 "config",

36 "containerization.md",

37 "README.md",

38 "LICENSE",

39 "CHANGELOG.md",

40 "scripts"

41 ],

42 "scripts": {

43 "clean": "shx rm -rf dist",

44 "dev": "tsgo -p tsconfig.build.json --watch --preserveWatchOutput",

45 "build": "tsgo -p tsconfig.build.json && shx chmod +x dist/cli.js dist/rpc-entry.js && npm run copy-assets",

46 "check:ext": "tsgo -p tsconfig.ext.json --noEmit",

47 "build:binary": "npm --prefix ../tui run build && npm --prefix ../telemetry run build && npm --prefix ../ai run build && npm --prefix ../agent run build && npm --prefix ../protocol run build && npm --prefix ../client run build && npm run build && bun build --compile --no-compile-autoload-bunfig ./dist/bun/cli.js ./src/utils/image-resize-worker.ts --outfile dist/phi && npm run copy-binary-assets",

48 "copy-assets": "shx mkdir -p dist/modes/interactive/theme dist/modes/interactive/assets dist/core/export-html/vendor dist/core && shx cp src/modes/interactive/theme/*.json dist/modes/interactive/theme/ && shx cp src/modes/interactive/assets/*.png dist/modes/interactive/assets/ && shx cp src/core/default-models.json dist/core/ && shx cp src/core/export-html/template.html src/core/export-html/template.css src/core/export-html/template.js dist/core/export-html/ && shx cp src/core/export-html/vendor/*.js dist/core/export-html/vendor/",

49 "copy-binary-assets": "shx cp package.json dist/ && shx cp README.md dist/ && shx cp CHANGELOG.md dist/ && shx mkdir -p dist/theme && shx cp src/modes/interactive/theme/*.json dist/theme/ && shx mkdir -p dist/assets && shx cp -r src/modes/interactive/assets dist/ 2>/dev/null || true && shx mkdir -p dist/export-html/vendor && shx cp src/core/export-html/template.html dist/export-html/ && shx cp src/core/export-html/vendor/*.js dist/export-html/vendor/ && shx cp -r docs dist/ && shx cp -r examples dist/ && shx cp ../../node_modules/@silvia-odwyer/photon-node/photon_rs_bg.wasm dist/",

50 "test": "vitest --run",

51 "prepublishOnly": "npm run clean && npm run build",

52 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L52

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L52

53 },

54 "dependencies": {

55 "@mariozechner/jiti": "^2.6.5",

56 "@modelcontextprotocol/sdk": "^1.29.0",

57 "@phi-code-admin/browser": "^1.0.4",

58 "@silvia-odwyer/photon-node": "0.3.4",

59 "chalk": "5.6.2",

60 "cli-highlight": "^2.1.11",

61 "cross-spawn": "7.0.6",

62 "diff": "8.0.4",

63 "extract-zip": "^2.0.1",

64 "file-type": "^21.1.1",

65 "glob": "13.0.6",

66 "grok-mermaid": "0.2.2",

67 "highlight.js": "10.7.3",

68 "hosted-git-info": "9.0.3",

69 "ignore": "7.0.5",

70 "jiti": "2.7.0",

71 "marked": "^15.0.12",

72 "minimatch": "10.2.5",

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

46

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath

dist/core/extensions/loader.jsView file

Lines 43-83javascript

43 // phi-code packages

44 "phi-code": _bundledPiCodingAgent,

45 "@phi-code-admin/phi-code": _bundledPiCodingAgent,

46 "phi-code-agent": _bundledPiAgentCore,

47 "phi-code-tui": _bundledPiTui,

48 // Extensions resolve the pi-ai root to the compat entrypoint (a strict

49

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg