@phren/cli@0.1.39: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@phren/cli@0.1.39: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/init/init-uninstall.jsView file

5import * as path from "path"; L6: import { execFileSync, spawnSync } from "child_process"; L7: import { atomicWriteText, debugLog, isRecord, hookConfigPath, homeDir, homePath, findPhrenPath, getProjectDirs, readRootManifest, } from "../shared.js";

High

Child Process

Package source references child process execution.

dist/init/init-uninstall.jsView on unpkg · L5

dist/ui/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @phren/cli@0.1.36 matchedIdentity = npm:QHBocmVuL2NsaQ:0.1.36 similarity = 0.892 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/ui/server.jsView on unpkg

38if (platform === "win32") L39: return { command: process.env.ComSpec || "cmd.exe", args: ["/c", "start", "", url] }; L40: return { command: "xdg-open", args: [url] };

High

Shell

Package source references shell execution.

dist/ui/server.jsView on unpkg · L38

dist/generated/memory-ui-graph.browser.jsView file

1"use strict";(()=>{var XN=Object.create;var SM=Object.defineProperty;var qN=Object.getOwnPropertyDescriptor;var ZN=Object.getOwnPropertyNames;var $N=Object.getPrototypeOf,eL=Object... L2: `,a=Array(s+1).join(" "),l=[];for(let c=0;c<e;++c){let u=zG(c),h=c===0?"":a;l.push(h+n.replace(/{var}/g,u))}return l.join(o)}}});var tI=Vi((qZ,pf)=>{var qT=gc();pf.exports=VG;pf.ex... L3: ${eI(i,e)}

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/generated/memory-ui-graph.browser.jsView on unpkg · L1

dist/init/init-walkthrough.jsView file

21try { L22: const chalkModule = await import(String("chalk")); L23: const chalkAny = chalkModule.default

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/init/init-walkthrough.jsView on unpkg · L21

dist/ui/data.jsView file

50return {}; L51: const parsed = JSON.parse(fs.readFileSync(runtimeHealth, "utf8")); L52: return {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/ui/data.jsView on unpkg · L50

dist/init/setup.jsView file

396: hookEntrypointOk L397: ? "Hook entrypoint available via npx fallback" L398: : "Hook entrypoint missing and npx unavailable, hooks will fail"; ... L407: try { L408: execFileSync("git", ["-C", phrenPath, "rev-parse", "--is-inside-work-tree"], { L409: stdio: ["ignore", "ignore", "ignore"],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/init/setup.jsView on unpkg · L396

Source & flagged code

7 flagged

dist/init/init-uninstall.jsView file

Lines 1-25javascript

1/**

2 * Uninstall logic for phren: removes MCP configs, hooks, symlinks, and data.

3 */

4import * as fs from "fs";

5import * as path from "path";

6import { execFileSync, spawnSync } from "child_process";

7import { atomicWriteText, debugLog, isRecord, hookConfigPath, homeDir, homePath, findPhrenPath, getProjectDirs, readRootManifest, } from "../shared.js";

High

Child Process

Package source references child process execution.

dist/init/init-uninstall.jsView on unpkg · L5

8import { errorMessage } from "../utils.js";

9import { FINDINGS_FILENAME } from "../data/access.js";

10import { codexJsonCandidates, copilotMcpCandidates, cursorMcpCandidates, vscodeMcpCandidates, } from "../provider-adapters.js";

11import { removeMcpServerAtPath, removeTomlMcpServer, isPhrenCommand, patchJsonFile, } from "./config.js";

12import { DEFAULT_PHREN_PATH, log } from "./shared.js";

13const PHREN_NPM_PACKAGE_NAME = "@phren/cli";

14function getNpmCommand() {

15 return process.platform === "win32" ? "npm.cmd" : "npm";

16}

17function runSyncCommand(command, args) {

18 try {

19 const result = spawnSync(command, args, {

20 encoding: "utf8",

21 stdio: ["ignore", "pipe", "pipe"],

22 });

23 return {

24 ok: result.status === 0,

25 status: result.status,

dist/ui/server.jsView file

Lines 18-58javascript

18import { getWorkflowPolicy, updateWorkflowPolicy, mergeConfig, getRetentionPolicy, getProjectConfigOverrides, getIndexPolicy, updateIndexPolicy, VALID_TASK_MODES } from "../governance/policy.js";

19import { setAccessRoles, ACCESS_ROLE_KEYS, permissionDeniedError } from "../governance/rbac.js";

20import { readProjectConfig, updateProjectConfigOverrides } from "../project-config.js";

21import { buildConfigView } from

dist/generated/memory-ui-graph.browser.jsView file

1"use strict";(()=>{var XN=Object.create;var SM=Object.defineProperty;var qN=Object.getOwnPropertyDescriptor;var ZN=Object.getOwnPropertyNames;var $N=Object.getPrototypeOf,eL=Object... L2: `,a=Array(s+1).join(" "),l=[];for(let c=0;c<e;++c){let u=zG(c),h=c===0?"":a;l.push(h+n.replace(/{var}/g,u))}return l.join(o)}}});var tI=Vi((qZ,pf)=>{var qT=gc();pf.exports=VG;pf.ex... L3: ${eI(i,e)}

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/generated/memory-ui-graph.browser.jsView on unpkg · L1

dist/init/init-walkthrough.jsView file

Lines 1-41javascript

1/**

2 * Interactive walkthrough for first-time phren init.

3 * Prompts the user through storage, identity, MCP, hooks, and feature configuration.

4 */

5import * as path from "path";

6import { PROJECT_OWNERSHIP_MODES } from "../project-config.js";

dist/ui/data.jsView file

Lines 30-70javascript

30function exactProjectMentions(text, projectSet, currentProject) {

31 const tokenMatches = text.toLowerCase().match(/[a-z0-9_-]+/g) ??

dist/init/setup.jsView file

Lines 376-416javascript

376export function getVerifyOutcomeNote(phrenPath, checks) {

377 const failures = checks.filter((check) => !check.ok);

378