Loading npm security reports…

@phi-code-admin/phi-code@0.99.0: Malicious npm security report | LPM Firewall

registry / @phi-code-admin/phi-code / 0.99.0

@phi-code-admin/phi-code@0.99.0

Coding agent CLI with persistent memory, sub-agents, intelligent routing, and orchestration

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Installing the package automatically mutates the shared Phi AI-agent control directory. It installs extensions, agents, skills, dependency links, and a settings change outside the consumer project.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm installation runs postinstall unless CI or PHI_SKIP_POSTINSTALL is set.

Impact

Package-controlled agent code becomes available through ~/.phi/agent without an explicit setup command.

Mechanism

Automatic home-directory AI-agent extension deployment and configuration mutation.

Attack narrative

The package declares an automatic postinstall hook. That hook copies package-supplied extensions, agents, and skills into ~/.phi/agent, force-overwriting destination entries, creates dependency links there, creates persistent memory directories, and modifies the agent settings file. This is unconsented install-time mutation of a broad AI-agent control surface rather than an explicit user-invoked setup action.

AI rationale

The lifecycle hook establishes automatic persistence in a shared AI-agent directory and changes its configuration. Although no postinstall exfiltration was found, the concrete control-surface mutation meets the install-hook abuse blocking policy.

Evidence

package.jsonscripts/postinstall.cjs~/.phi/agent/extensions~/.phi/agent/agents~/.phi/agent/skills~/.phi/agent/extensions/node_modules~/.phi/agent/settings.json~/.phi/memory

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/exec.jsView file

3*/ L4: import { spawn } from "node:child_process"; L5: import { waitForChildProcess } from "../utils/child-process.js";

High

Child Process

Package source references child process execution.

dist/core/exec.jsView on unpkg · L3

dist/utils/tools-manager.jsView file

209const script = "& { param($archive, $destination) $ErrorActionPreference = 'Stop'; Expand-Archive -LiteralPath $archive -DestinationPath $destination -Force }"; L210: const powershellFailure = runExtractionCommand("powershell.exe", [ L211: "-NoLogo",

High

Shell

Package source references shell execution.

dist/utils/tools-manager.jsView on unpkg · L209

examples/extensions/doom-overlay/doom-engine.tsView file

64const nativeRequire = createRequire(doomJsPath); L65: const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode); L66: moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

dist/core/extensions/loader.jsView file

63}; L64: const require = createRequire(import.meta.url); L65: const isTypeScriptSourceRuntime = !isBunBinary && path.extname(fileURLToPath(import.meta.url)) === ".ts";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/extensions/loader.jsView on unpkg · L63

dist/core/tools/edit-hashline.jsView file

1import { createHash } from "crypto"; L2: // Local copy of edit-diff's fuzzy normalization, duplicated to avoid an

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/tools/edit-hashline.jsView on unpkg · L1

examples/extensions/doom-overlay/doom/build/doom.jsView file

7L8: var Module=moduleArg;var readyPromiseResolve,readyPromiseReject;var readyPromise=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=reject});var ENVIRONM... L9:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

examples/extensions/doom-overlay/doom/build/doom.jsView on unpkg · L7

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

dist/config.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/config.js#virtual:string-array:round1View on unpkg

dist/utils/shell.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @phi-code-admin/phi-code@0.98.2 matchedIdentity = npm:[redacted]:0.98.2 similarity = 0.783 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/utils/shell.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 32-72json

32 "skills",

33 "agents",

34 "extensions",

35 "config",

36 "containerization.md",

37 "README.md",

38 "LICENSE",

39 "CHANGELOG.md",

40 "scripts"

41 ],

42 "scripts": {

43 "clean": "shx rm -rf dist",

44 "dev": "tsgo -p tsconfig.build.json --watch --preserveWatchOutput",

45 "build": "tsgo -p tsconfig.build.json && shx chmod +x dist/cli.js dist/rpc-entry.js && npm run copy-assets",

46 "check:ext": "tsgo -p tsconfig.ext.json --noEmit",

47 "build:binary": "npm --prefix ../tui run build && npm --prefix ../telemetry run build && npm --prefix ../ai run build && npm --prefix ../agent run build && npm --prefix ../protocol run build && npm --prefix ../client run build && npm run build && bun build --compile --no-compile-autoload-bunfig ./dist/bun/cli.js ./src/utils/image-resize-worker.ts --outfile dist/phi && npm run copy-binary-assets",

48 "copy-assets": "shx mkdir -p dist/modes/interactive/theme dist/modes/interactive/assets dist/core/export-html/vendor dist/core && shx cp src/modes/interactive/theme/*.json dist/modes/interactive/theme/ && shx mkdir -p dist/modes/interactive/theme/defaults && shx cp src/modes/interactive/theme/defaults/*.json dist/modes/interactive/theme/defaults/ && shx cp src/modes/interactive/assets/*.png dist/modes/interactive/assets/ && shx cp src/core/default-models.json dist/core/ && shx cp src/core/export-html/template.html src/core/export-html/template.css src/core/export-html/template.js dist/core/e ...

49 "copy-binary-assets": "shx cp package.json dist/ && shx cp README.md dist/ && shx cp CHANGELOG.md dist/ &&

50 "test": "vitest --run",

51 "prepublishOnly": "npm run clean && npm run build",

52 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L52

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L52

53 },

54 "dependencies": {

55 "@ast-grep/napi": "0.45.3",

56 "@mariozechner/jiti": "^2.6.5",

57 "@modelcontextprotocol/sdk": "^1.29.0",

58 "@phi-code-admin/browser": "^1.0.4",

59 "@silvia-odwyer/photon-node": "0.3.4",

60 "chalk": "5.6.2",

61 "cli-highlight": "^2.1.11",

62 "cross-spawn": "7.0.6",

63 "diff": "8.0.4",

64 "extract-zip": "^2.0.1",

65 "file-type": "^21.1.1",

66 "glob": "13.0.6",

67 "grok-mermaid": "0.2.2",

68 "highlight.js": "10.7.3",

69 "hosted-git-info": "9.0.3",

70 "ignore": "7.0.5",

71 "jiti": "2.7.0",

72 "marked": "^15.0.12",

Long lines were clipped for display.

dist/core/exec.jsView file

Lines 1-23javascript

1/**

2 * Shared command execution utilities for extensions and custom tools.

3 */

4import { spawn } from "node:child_process";

5import { waitForChildProcess } from "../utils/child-process.js";

High

Child Process

Package source references child process execution.

dist/core/exec.jsView on unpkg · L3

dist/utils/tools-manager.jsView file

Lines 189-229javascript

189}

190function getWindowsTarCommand() {

191 const systemRoot = process.env.SystemRoot ?? process.env.WINDIR;

192 if (systemRoot) {

193 const

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

46

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath

dist/core/extensions/loader.jsView file

Lines 43-83javascript

43 // phi-code packages

44 "phi-code": _bundledPiCodingAgent,

45 "@phi-code-admin/phi-code": _bundledPiCodingAgent,

46 "phi-code-agent": _bundledPiAgentCore,

47 "phi-code-tui": _bundledPiTui,

48 // Extensions resolve the pi-ai root to the compat entrypoint (a strict

49

dist/core/tools/edit-hashline.jsView file

Lines 1-21javascript

1import { createHash } from "crypto";

2// Local copy of edit-diff's fuzzy normalization, duplicated to avoid an

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/tools/edit-hashline.jsView on unpkg · L1

3// import cycle (edit-diff.ts imports this module for anchor recovery).

4function normalizeForFuzzyMatch(text) {

5

examples/extensions/doom-overlay/doom/build/doom.jsView file

Lines 1-22javascript

1var createDoomModule = (() => {

2 var _scriptName = typeof document != 'undefined' ? document.currentScript?.src : undefined;

3

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

dist/config.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/config.js#virtual:string-array:round1View on unpkg

dist/utils/shell.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @phi-code-admin/phi-code@0.98.2 matchedIdentity = npm:[redacted]:0.98.2 similarity = 0.783 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/utils/shell.jsView on unpkg