registry / phantomx-tool-client / 1.1.3

phantomx-tool-client@1.1.3

Self-hosted tool-server client that connects to a remote orchestration server and executes tools locally

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 189 KB of source, external domains: api.github.com, github.com

Source & flagged code

4 flagged

dist/githubOperationsHanlder.jsView file

Lines 719-759javascript

719 }

720 return {

721 repoName,

722 branchName: currentBranch,

723 commitHash,

724 commitsAhead,

725 pushedAt: new Date().toISOString()

726 };

727 }

728 finally {

729 }

730 }

731 /**

732 * Check repository status

733 */

734 async checkRepositoryStatus(repoName, socket) {

735 const repoPath = `${tool_server_1.folderPath}/${repoName}`;

736 const installationToken = await fetchInstallationToken();

737 const gitOrgName = await getGithubOrganizationName();

738 // const repoPath = 'mnt/f/PhantomX-workspace/93943752-2576-44ee-9b57-4b6fb3130fe4/AI_CODER_REMOTE'

739 // const installationToken = "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";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/githubOperationsHanlder.jsView on unpkg · L739

Critical

Secret Pattern

GitHub personal access token in dist/githubOperationsHanlder.js

dist/githubOperationsHanlder.jsView on unpkg · L739

740 // const gitOrgName = "AI-PLAYGROUNDS";

741 try {

742 logger.info('Checking repository status', { repoName });

743 // Combine all git commands into a single SSH call

744 const combinedCommand = `

745 cd ${repoPath} &&

746 BRANCH=$(sudo git rev-parse --abbrev-ref HEAD) &&

747 sudo git remote set-url origin https://x-access-token:${installationToken}@github.com/${gitOrgName}/${repoName}.git &&

748 sudo git fetch origin &&

749 sudo git remote set-url origin https://github.com/${gitOrgName}/${repoName}.git &&

750 BEHIND=$(sudo git rev-list --count HEAD..origin/$BRANCH 2>/dev/null || echo 0) &&

751 AHEAD=$(sudo git rev-list --count origin/$BRANCH..HEAD 2>/dev/null || echo 0) &&

752 STATUS=$(sudo git status --porcelain) &&

753 CURRENT_HASH=$(sudo git rev-parse HEAD) &&

754 REMOTE_HASH=$(sudo git rev-parse origin/$BRANCH 2>/dev/null || echo unknown) &&

755 echo "BRANCH:$BRANCH" &&

756 echo "BEHIND:$BEHIND" &&

757 echo "AHEAD:$AHEAD" &&

758 echo "STATUS:$STATUS" &&

759 echo "CURRENT:$CURRENT_HASH" &&

•matchType = previous_version_dangerous_delta matchedPackage = phantomx-tool-client@1.0.8 matchedIdentity = npm:cGhhbnRvbXgtdG9vbC1jbGllbnQ:1.0.8 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/githubOperationsHanlder.jsView on unpkg

package.jsonView file

Lines 1-35json

2 "name": "phantomx-tool-client",

3 "version": "1.1.3",

4 "description": "Self-hosted tool-server client that connects to a remote orchestration server and executes tools locally",

5 "main": "dist/tool-server.js",

Source & flagged code

4 flagged · loading source

dist/githubOperationsHanlder.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code