phantomx-tool-client
Self-hosted tool-server client that connects to a remote orchestration server and executes tools locally
This report shows the evidence for phantomx-tool-client@1.0.8. 1 of 22 known versions is blocked or flagged. The newest version, 1.3.3, is allowed. See all versions.
OpenSSF/OSV Malicious Advisory
imported 3mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-10745 confirms this npm version as malicious.
Advisory
MAL-2026-10745
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in phantomx-tool-client (npm)
Details
When the `tool-server` bin is launched, the package establishes a persistent Socket.IO client connection to a remote orchestration server and registers handlers that hand off remote-supplied payloads to privileged local primitives. `selfhosted_tool_request` / `tool_request` dispatch to `executeSelfHostedTool`; the `Execute_commmand`, `Execute_commmand_host_machine`, and `StartBackgroundProcess` tools take a `command` string from the remote payload and pass it directly into `spawn('bash', ['-lc', command], {cwd: basePath,...})`, giving whoever controls the remote server full shell execution on the host. `remote_edit_request` applies arbitrary file edits via `editTool.applyFinalEdit(data.edits)` where each `edit.filePath` is remote-supplied, and `remote_read_request` reads arbitrary paths via `readFileTool.readFile({absolutePath: data.options.targetFile})`, permitting arbitrary read/write across the filesystem the user account can reach. The GitHub operations handler (`dist/githubOperationsHanlder.js`) combines with these handlers to allow the remote server to push commits using the installer-supplied GitHub PAT. Once the CLI is running, control of the configured Socket.IO server is equivalent to interactive host access.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The package exposes a high-risk remote command-and-file-control channel controlled by a runtime-selected server. It is not proven malicious because it lacks install-time execution, a fixed attacker endpoint, or concealment, but warrants a warning as dangerous capability.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running `tool-server` or importing `dist/tool-server.js` with a server URL argument.
Impact
A controlling server can execute commands on the host and exfiltrate readable file contents, including command output.
Mechanism
Remote Socket.IO-controlled shell execution and unrestricted absolute-path file operations.
AI rationale
The package exposes a high-risk remote command-and-file-control channel controlled by a runtime-selected server. It is not proven malicious because it lacks install-time execution, a fixed attacker endpoint, or concealment, but warrants a warning as dangerous capability.
Evidence
package.jsonbin/tool-server.jsdist/tool-server.jsdist/toolExecutionService.jsdist/Services/EditTool.jsdist/Services/ReadFileTool.jsdist/githubOperationsHanlder.js
Network endpoints1
api.github.com
Independent scan evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for AI warning decision
- `dist/tool-server.js` accepts Socket.IO requests from a runtime-supplied `SERVER_URL`.
- `dist/toolExecutionService.js` runs remote command strings with `bash -lc` on the host.
- Remote `Execute_commmand_host_machine` and background-process tools provide arbitrary host execution.
- `remote_read_request` reads caller-supplied absolute paths and returns contents over the socket.
- `remote_edit_request` applies socket-supplied edits to absolute file paths.
- `dist/githubOperationsHanlder.js` uses the supplied GitHub PAT for GitHub API and git operations.
Evidence against
- `package.json` only defines `prepare`; no preinstall/install/postinstall hook exists.
- No hard-coded non-GitHub network endpoint, stealth payload download, or obfuscated payload was found.
- The manifest describes a self-hosted remote tool client, aligning with the exposed capability.
- GitHub traffic targets the package-aligned `https://api.github.com` endpoint.
Behavioral surface
ChildProcessEnvironmentVars
Source & flagged code
2 flagged · loading sourcepackage.jsonView file
•Runtime dependency names matching Node built-ins: fs, http, path
High
Node Builtin Dependency Squat
Package declares a runtime dependency whose name matches a Node built-in module.
package.jsonView on unpkgdist/githubOperationsHanlder.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = phantomx-tool-client@1.0.7
matchedIdentity = npm:cGhhbnRvbXgtdG9vbC1jbGllbnQ:1.0.7
similarity = 0.857
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/githubOperationsHanlder.jsView on unpkgFindings
2 High2 Medium5 Low
HighNode Builtin Dependency Squatpackage.json
HighPrevious Version Dangerous Deltadist/githubOperationsHanlder.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to phantomx-tool-client@1.0.8.
The versions list below shows the verdict for each recorded version.
- Avoid installing phantomx-tool-client@1.0.8. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.