registry / @phren/cli / 0.1.35

@phren/cli@0.1.35

Knowledge layer for AI agents — CLI, MCP server, and data layer

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 180 file(s), 3.65 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.openai.com, cdn.jsdelivr.net, fonts.bunny.net, ollama.com, www.w3.org

Source & flagged code

5 flagged

dist/init/init-uninstall.jsView file

Lines 1-25javascript

1/**

2 * Uninstall logic for phren: removes MCP configs, hooks, symlinks, and data.

3 */

4import * as fs from "fs";

5import * as path from "path";

6import { execFileSync, spawnSync } from "child_process";

7import { atomicWriteText, debugLog, isRecord, hookConfigPath, homeDir, homePath, findPhrenPath, getProjectDirs, readRootManifest, } from "../shared.js";

High

Child Process

Package source references child process execution.

dist/init/init-uninstall.jsView on unpkg · L5

8import { errorMessage } from "../utils.js";

9import { FINDINGS_FILENAME } from "../data/access.js";

10import { codexJsonCandidates, copilotMcpCandidates, cursorMcpCandidates, vscodeMcpCandidates, } from "../provider-adapters.js";

11import { removeMcpServerAtPath, removeTomlMcpServer, isPhrenCommand, patchJsonFile, } from "./config.js";

12import { DEFAULT_PHREN_PATH, log } from "./shared.js";

13const PHREN_NPM_PACKAGE_NAME = "@phren/cli";

14function getNpmCommand() {

15 return process.platform === "win32" ? "npm.cmd" : "npm";

16}

17function runSyncCommand(command, args) {

18 try {

19 const result = spawnSync(command, args, {

20 encoding: "utf8",

21 stdio: ["ignore", "pipe", "pipe"],

22 });

23 return {

24 ok: result.status === 0,

25 status: result.status,

dist/ui/server.jsView file

Lines 14-54javascript

14import { lookupEventsLogFile } from "../shared.js";

15import { CONSOLIDATION_ENTRY_THRESHOLD } from "../content/validate.js";

16import { ensureTopicReferenceDoc, getProjectTopicsResponse, listProjectReferenceDocs, pinProjectTopicSuggestion, readReferenceContent, reclassifyLegacyTopicDocs, unpinProjectTopicSuggestion, writeProjectTopics, } from "../project-topics.js";

17import { getWorkflowPolicy, updateWorkflowPolicy, mergeConfig, getRetentionPolicy, getProjectConfigOverrides, getIndexPolicy, updateIndexPolicy, VALID_TASK_MODES }

dist/generated/memory-ui-graph.browser.jsView file

1"use strict";(()=>{var Cr=Object.create;var vt=Object.defineProperty;var wr=Object.getOwnPropertyDescriptor;var cr=Object.getOwnPropertyNames;var fr=Object.getPrototypeOf,hr=Object... L2: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function YA(i,e){return Ln(i)||bn(i,e)||At(i,e)||Hn()}var Ze={black:"#000000",silver:"#C0C0C0",...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/generated/memory-ui-graph.browser.jsView on unpkg · L1

dist/ui/data.jsView file

Lines 30-70javascript

30function exactProjectMentions(text, projectSet, currentProject) {

31 const tokenMatches = text.toLowerCase().match(/[a-z0-9_-]+/g) ??

dist/init/setup.jsView file

Lines 376-416javascript

376export function getVerifyOutcomeNote(phrenPath, checks) {

377 const failures = checks.filter((check) => !check.ok);

378

Source & flagged code

5 flagged · loading source

dist/init/init-uninstall.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code