@phren/cli@0.1.36: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@phren/cli@0.1.36: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/init/init-uninstall.jsView file

5import * as path from "path"; L6: import { execFileSync, spawnSync } from "child_process"; L7: import { atomicWriteText, debugLog, isRecord, hookConfigPath, homeDir, homePath, findPhrenPath, getProjectDirs, readRootManifest, } from "../shared.js";

High

Child Process

Package source references child process execution.

dist/init/init-uninstall.jsView on unpkg · L5

dist/ui/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @phren/cli@0.1.35 matchedIdentity = npm:QHBocmVuL2NsaQ:0.1.35 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/ui/server.jsView on unpkg

35if (platform === "win32") L36: return { command: process.env.ComSpec || "cmd.exe", args: ["/c", "start", "", url] }; L37: return { command: "xdg-open", args: [url] };

High

Shell

Package source references shell execution.

dist/ui/server.jsView on unpkg · L35

dist/generated/memory-ui-graph.browser.jsView file

1"use strict";(()=>{var HF=Object.create;var NE=Object.defineProperty;var zF=Object.getOwnPropertyDescriptor;var VF=Object.getOwnPropertyNames;var YF=Object.getPrototypeOf,KF=Object... L2: `,a=Array(s+1).join(" "),c=[];for(let l=0;l<e;++l){let u=NO(l),h=l===0?"":a;c.push(h+n.replace(/{var}/g,u))}return c.join(o)}}});var lT=Qi((Bq,Kd)=>{var sT=rl();Kd.exports=LO;Kd.ex... L3: ${cT(i,e)}

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/generated/memory-ui-graph.browser.jsView on unpkg · L1

dist/init/init-walkthrough.jsView file

21try { L22: const chalkModule = await import(String("chalk")); L23: const chalkAny = chalkModule.default

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/init/init-walkthrough.jsView on unpkg · L21

dist/ui/data.jsView file

50return {}; L51: const parsed = JSON.parse(fs.readFileSync(runtimeHealth, "utf8")); L52: return {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/ui/data.jsView on unpkg · L50

dist/init/setup.jsView file

396: hookEntrypointOk L397: ? "Hook entrypoint available via npx fallback" L398: : "Hook entrypoint missing and npx unavailable, hooks will fail"; ... L407: try { L408: execFileSync("git", ["-C", phrenPath, "rev-parse", "--is-inside-work-tree"], { L409: stdio: ["ignore", "ignore", "ignore"],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/init/setup.jsView on unpkg · L396

Source & flagged code

7 flagged

dist/init/init-uninstall.jsView file

Lines 1-25javascript

1/**

2 * Uninstall logic for phren: removes MCP configs, hooks, symlinks, and data.

3 */

4import * as fs from "fs";

5import * as path from "path";

6import { execFileSync, spawnSync } from "child_process";

7import { atomicWriteText, debugLog, isRecord, hookConfigPath, homeDir, homePath, findPhrenPath, getProjectDirs, readRootManifest, } from "../shared.js";

High

Child Process

Package source references child process execution.

dist/init/init-uninstall.jsView on unpkg · L5

8import { errorMessage } from "../utils.js";

9import { FINDINGS_FILENAME } from "../data/access.js";

10import { codexJsonCandidates, copilotMcpCandidates, cursorMcpCandidates, vscodeMcpCandidates, } from "../provider-adapters.js";

11import { removeMcpServerAtPath, removeTomlMcpServer, isPhrenCommand, patchJsonFile, } from "./config.js";

12import { DEFAULT_PHREN_PATH, log } from "./shared.js";

13const PHREN_NPM_PACKAGE_NAME = "@phren/cli";

14function getNpmCommand() {

15 return process.platform === "win32" ? "npm.cmd" : "npm";

16}

17function runSyncCommand(command, args) {

18 try {

19 const result = spawnSync(command, args, {

20 encoding: "utf8",

21 stdio: ["ignore", "pipe", "pipe"],

22 });

23 return {

24 ok: result.status === 0,

25 status: result.status,

dist/ui/server.jsView file

Lines 15-55javascript

15import { lookupEventsLogFile } from "../shared.js";

16import { CONSOLIDATION_ENTRY_THRESHOLD } from "../content/validate.js";

17import { ensureTopicReferenceDoc, getProjectTopicsResponse, listProjectReferenceDocs, pinProjectTopicSuggestion, readReferenceContent, reclassifyLegacyTopicDocs, unpinProjectTopicSuggestion, writeProjectTopics, } from "../project-topics.js";

18import { getWorkflowPolicy, updateWorkflowPolicy, mergeConfig, getRetentionPolicy, getProjectConfigOverrides, getIndexPolicy, updateIndexPolicy, VALID_TASK_MODES }

dist/generated/memory-ui-graph.browser.jsView file

1"use strict";(()=>{var HF=Object.create;var NE=Object.defineProperty;var zF=Object.getOwnPropertyDescriptor;var VF=Object.getOwnPropertyNames;var YF=Object.getPrototypeOf,KF=Object... L2: `,a=Array(s+1).join(" "),c=[];for(let l=0;l<e;++l){let u=NO(l),h=l===0?"":a;c.push(h+n.replace(/{var}/g,u))}return c.join(o)}}});var lT=Qi((Bq,Kd)=>{var sT=rl();Kd.exports=LO;Kd.ex... L3: ${cT(i,e)}

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/generated/memory-ui-graph.browser.jsView on unpkg · L1

dist/init/init-walkthrough.jsView file

Lines 1-41javascript

1/**

2 * Interactive walkthrough for first-time phren init.

3 * Prompts the user through storage, identity, MCP, hooks, and feature configuration.

4 */

5import * as path from "path";

6import { PROJECT_OWNERSHIP_MODES } from "../project-config.js";

dist/ui/data.jsView file

Lines 30-70javascript

30function exactProjectMentions(text, projectSet, currentProject) {

31 const tokenMatches = text.toLowerCase().match(/[a-z0-9_-]+/g) ??

dist/init/setup.jsView file

Lines 376-416javascript

376export function getVerifyOutcomeNote(phrenPath, checks) {

377 const failures = checks.filter((check) => !check.ok);

378