registry / phewsh / 0.15.70

phewsh@0.15.70

⚠ Under review

Turn intent into action. Structure your thinking, execute your next step.

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 91 file(s), 754 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.deepseek.com, api.github.com, api.groq.com, api.mistral.ai, api.openai.com, api.together.xyz, claude.ai, console.anthropic.com, cursor.com, developer.mozilla.org, docs.anthropic.com, fpnpfnahwaztdlxuayyv.supabase.co, github.com, news.ycombinator.com, openrouter.ai, phewsh.com, registry.npmjs.org, sustainableaiprotocol.com, www.phewsh.com, youtube.com

Source & flagged code

7 flagged

lib/harnesses.jsView file

Lines 1-31javascript

1// Agent harnesses installed on this machine, and how to invoke them headlessly.

2//

3// PHEWSH is not a harness — it's the layer that uses the ones you already

4// have. Each of these carries its OWN auth (Claude Code uses your Claude

5// subscription, Codex your ChatGPT plan, Gemini your Google login), so going

6// through them needs no API key in phewsh at all.

7//

8// Used by:

9// phewsh serve — web-dispatched jobs execute through these

10// phewsh ai — harnesses double as no-key providers

12const { execSync, spawn } = require('child_process');

High

Child Process

Package source references child process execution.

lib/harnesses.jsView on unpkg · L11

14// args: how to run a one-shot prompt headlessly. args: null = we only know

15// how to launch it interactively (detection + /work still fully supported —

16// never guess flags; a wrong invocation looks like phewsh being broken).

17//

18// args takes (prompt, model). model is passed straight through to the

19// harness's own flag and validated BY the harness — phewsh keeps no model

20// list of its own, so it can never go stale. Harnesses without a known

21// model flag ignore the preference and use their own config.

22const HARNESSES = {

23 'claude-code': { bin: 'claude', label: 'Claude Code', role: 'writes code', bestFor: 'repo edits, tests, native coding loops', auth: 'Claude subscription / Console', models: true, modelHints: ['sonnet', 'opus', 'haiku'], streamFormat: 'claude-json', args: (p, m) => ['-p', p, '--output-format', 'stream-json', '--include-partial-messages', '--verbose', ...(m ? ['--model', m]

24 'codex': { bin: 'codex', label: 'Codex CLI', role: 'reasons & reviews', bestFor: 'reviews, reasoning, second opinions', auth: 'ChatGPT plan', models: true, args: (p, m) => ['exec', '--skip-git-repo-check', ...(m ? ['-m', m] : []), p], interactiveArgs: (brief, m) => [...(m ? ['-m'

25 'gemini': { bin: 'gemini', label: 'Gemini CLI', role: "another model's take", bestFor: 'broad scans, alternate framing', auth: 'Google login', models: true, args: (p, m) => ['-p', p, ...(m ? ['-m', m] : [])], interactiveArgs: (brief, m) => ['--prompt-interactive', brief, ...(m ? ['--model'

26 'cursor': { bin: 'cursor-agent', label: 'Cursor Agent', role: 'edits files', bestFor: 'editor-side file edits', auth: 'Cursor account', models: true, args: (p, m) => ['-p', p, '--output-format', 'text', ...(m ? ['--model', m] : [])] },

27 'opencode': { bin: 'opencode', label: 'OpenCode', role: 'general agent', bestFor: 'open-source agent work', auth: 'OpenCode Zen / configured', args: (p) => ['run', p], interactiveArgs: (brief) => ['--prompt', brief] },

28 'grok': { bin: 'grok', label: 'Grok Build', role: "xAI's take", bestFor: 'outside take from xAI', auth: 'SuperGrok / X Premium+', args: (p) => ['-p', p] },

29 'kiro': { bin: 'kiro-cli', label: 'Kiro CLI', role: 'spec-driven dev', bestFor: 'spec-driven development', auth: 'Kiro / AWS account', args: (p) => ['chat', '--no-interactive', p] },

30 'copilot': { bin: 'copilot', label: 'Copilot CLI', role: 'github-native', bestFor: 'GitHub-native tasks', auth: 'GitHub Copilot plan', args: (p) => ['-p', p] },

31 'hermes': { bin: 'hermes', label: 'Hermes', role: 'runs loops', bestFor: 'orchestration and continuity', auth: 'Nous account', args: null },

lib/sequencer/ranker.jsView file

Lines 1-21javascript

1// Rank memory chunks by recency, impact, source authority, and deduplication.

2// Weight = recency * impact * sourceAuthority * dedupPenalty

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/sequencer/ranker.jsView on unpkg · L1

4const crypto = require('crypto');

6// Impact by chunk kind — what matters most across all contexts

7const KIND_IMPACT =

lib/shims.jsView file

Lines 1-38javascript

1// phewsh shims — the GUARANTEE layer.

2//

3// The lesson from four dogfood rounds: a model can't be relied on to prove

4// phewsh is active (it may flag a prose block, or ignore it). So phewsh proves

5// it ITSELF. A shim is a tiny script named like the user's tool (`claude`,

6// `codex`, …) placed first on PATH. When the user runs `claude`, the shim:

7// 1. prints a deterministic phewsh status banner (phewsh prints it — not the

8// model, so it's guaranteed), then

9// 2. exec's the REAL tool, unchanged.

10//

11// NON-NEGOTIABLE SAFETY: the shim must ALWAYS run the real tool, even if phewsh

commands/mcp.jsView file

Lines 133-173javascript

133 console.log(g(` Could not fetch cloud projects: ${err.message}`));

134 return [];

135 }

136}

137

138// The server is bundled with this package — no hunting.

139const MCP_SERVER_PATH = path.join(__dirname, '..',

commands/mbhd.jsView file

Lines 1-19javascript

1const { execFileSync } = require('child_process');

3const WEB_URL = 'https://phewsh.com/mbhd';

5console.log(`\n 🎵 Opening MBHD Music Engine...\n`);

7try {

commands/session.jsView file

Lines 2580-2620javascript

2580 execFileSync(process.execPath, [path.join(__dirname, '..', 'bin', 'phewsh.js'), 'outcomes', ...outcomesArgs], { stdio: 'inherit' });

2581 } catch { /* user quit mid-labeling — fine */ }

2582 rl.prompt();

2583 return;

2584 }

commands/task.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = phewsh@0.15.67 matchedIdentity = npm:cGhld3No:0.15.67 similarity = 0.978 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

commands/task.jsView on unpkg

Source & flagged code

7 flagged · loading source

lib/harnesses.jsView file

11L12: const { execSync, spawn } = require('child_process'); L13:

High

Child Process

Package source references child process execution.

lib/harnesses.jsView on unpkg · L11

lib/sequencer/ranker.jsView file

1// Rank memory chunks by recency, impact, source authority, and deduplication. L2: // Weight = recency * impact * sourceAuthority * dedupPenalty

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/sequencer/ranker.jsView on unpkg · L1

lib/shims.jsView file

18const os = require('os'); L19: const { execFileSync } = require('child_process'); L20: L21: const PHEWSH_DIR = path.join(os.homedir(), '.phewsh'); L22: const SHIM_DIR = path.join(PHEWSH_DIR, 'shims'); ... L34: try { L35: const cleanPath = (process.env.PATH || '') L36: .split(path.delimiter) ... L38: .join(path.delimiter); L39: const cmd = process.platform === 'win32' ? `where ${bin}` : `command -v ${bin}`; L40: const out = execFileSync('sh', ['-c', cmd], { ... L52: function shimScript(bin, realPath) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/shims.jsView on unpkg · L18

commands/mcp.jsView file

153try { L154: const res = await fetch(`http://127.0.0.1:${port}/health`, { L155: signal: AbortSignal.timeout(800), ... L166: ensureDirs(); L167: const child = spawn(process.execPath, [MCP_SERVER_PATH], { L168: stdio: 'inherit', L169: env: { ...process.env }, L170: });

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

commands/mcp.jsView on unpkg · L153

commands/mbhd.jsView file

1const { execFileSync } = require('child_process'); L2: L3: const WEB_URL = 'https://phewsh.com/mbhd'; L4: ... L8: // execFileSync (no shell) — argument-safe even though the URL is constant. L9: if (process.platform === 'darwin') { L10: execFileSync('open', [WEB_URL]);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

commands/mbhd.jsView on unpkg · L1

commands/session.jsView file

2600const { execSync } = require('child_process'); L2601: execSync(`npm install -g ${pkg.name}@latest`, { stdio: 'inherit' }); L2602: console.log(`\n ${teal('●')} ${sage('Updated to')} ${cream(data.version)}`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

commands/session.jsView on unpkg · L2600

commands/task.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

commands/task.jsView on unpkg

Findings

1 Critical5 High4 Medium6 Low

CriticalPrevious Version Dangerous Deltacommands/task.js

HighChild Processlib/harnesses.js

HighShell

HighSame File Env Network Executioncommands/mcp.js

HighSandbox Evasion Gated Capabilitycommands/mbhd.js

HighRuntime Package Installcommands/session.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencelib/shims.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptolib/sequencer/ranker.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

lib/harnesses.jsView file

Lines 1-31javascript

1// Agent harnesses installed on this machine, and how to invoke them headlessly.

2//

3// PHEWSH is not a harness — it's the layer that uses the ones you already

4// have. Each of these carries its OWN auth (Claude Code uses your Claude

5// subscription, Codex your ChatGPT plan, Gemini your Google login), so going

6// through them needs no API key in phewsh at all.

7//

8// Used by:

9// phewsh serve — web-dispatched jobs execute through these

10// phewsh ai — harnesses double as no-key providers

12const { execSync, spawn } = require('child_process');

High

Child Process

Package source references child process execution.

lib/harnesses.jsView on unpkg · L11

14// args: how to run a one-shot prompt headlessly. args: null = we only know

15// how to launch it interactively (detection + /work still fully supported —

16// never guess flags; a wrong invocation looks like phewsh being broken).

17//

18// args takes (prompt, model). model is passed straight through to the

19// harness's own flag and validated BY the harness — phewsh keeps no model

20// list of its own, so it can never go stale. Harnesses without a known

21// model flag ignore the preference and use their own config.

22const HARNESSES = {

28 'grok': { bin: 'grok', label: 'Grok Build', role: "xAI's take", bestFor: 'outside take from xAI', auth: 'SuperGrok / X Premium+', args: (p) => ['-p', p] },

29 'kiro': { bin: 'kiro-cli', label: 'Kiro CLI', role: 'spec-driven dev', bestFor: 'spec-driven development', auth: 'Kiro / AWS account', args: (p) => ['chat', '--no-interactive', p] },

30 'copilot': { bin: 'copilot', label: 'Copilot CLI', role: 'github-native', bestFor: 'GitHub-native tasks', auth: 'GitHub Copilot plan', args: (p) => ['-p', p] },

31 'hermes': { bin: 'hermes', label: 'Hermes', role: 'runs loops', bestFor: 'orchestration and continuity', auth: 'Nous account', args: null },

lib/sequencer/ranker.jsView file

Lines 1-21javascript

1// Rank memory chunks by recency, impact, source authority, and deduplication.

2// Weight = recency * impact * sourceAuthority * dedupPenalty

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/sequencer/ranker.jsView on unpkg · L1

4const crypto = require('crypto');

6// Impact by chunk kind — what matters most across all contexts

7const KIND_IMPACT =

lib/shims.jsView file

Lines 1-38javascript

1// phewsh shims — the GUARANTEE layer.

2//

3// The lesson from four dogfood rounds: a model can't be relied on to prove

4// phewsh is active (it may flag a prose block, or ignore it). So phewsh proves

5// it ITSELF. A shim is a tiny script named like the user's tool (`claude`,

6// `codex`, …) placed first on PATH. When the user runs `claude`, the shim:

7// 1. prints a deterministic phewsh status banner (phewsh prints it — not the

8// model, so it's guaranteed), then

9// 2. exec's the REAL tool, unchanged.

10//

11// NON-NEGOTIABLE SAFETY: the shim must ALWAYS run the real tool, even if phewsh

commands/mcp.jsView file

Lines 133-173javascript

133 console.log(g(` Could not fetch cloud projects: ${err.message}`));

134 return [];

135 }

136}

137

138// The server is bundled with this package — no hunting.

139const MCP_SERVER_PATH = path.join(__dirname, '..',

commands/mbhd.jsView file

Lines 1-19javascript

1const { execFileSync } = require('child_process');

3const WEB_URL = 'https://phewsh.com/mbhd';

5console.log(`\n 🎵 Opening MBHD Music Engine...\n`);

7try {

commands/session.jsView file

Lines 2580-2620javascript

2580 execFileSync(process.execPath, [path.join(__dirname, '..', 'bin', 'phewsh.js'), 'outcomes', ...outcomesArgs], { stdio: 'inherit' });

2581 } catch { /* user quit mid-labeling — fine */ }

2582 rl.prompt();

2583 return;

2584 }

commands/task.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

commands/task.jsView on unpkg