registry / @devflow-tools/devflow / 0.18.25

@devflow-tools/devflow@0.18.25

⚠ Under review

Installable DevFlow distribution containing the CLI, runtime hooks, and Claude plugin.

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 20 low-signal pattern(s) were surfaced and cleared.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 79 file(s), 2.78 MB of source, external domains: 127.0.0.1, github.com, nextjs.org, react.dev, reactflow.dev, www.w3.org

Source & flagged code

12 flagged

package.jsonView file

Lines 1-38json

2 "name": "@devflow-tools/devflow",

3 "version": "0.18.25",

4 "type": "module",

5 "description": "Installable DevFlow distribution containing the CLI, runtime hooks, and Claude plugin.",

6 "bin": {

7 "devflow": "./bin/devflow"

8 },

9 "scripts": {

10 "build": "tsup",

11 "bundle:dashboard": "test -f ../../apps/dashboard/out/index.html || npm run build -w apps/dashboard; rm -rf dist/dashboard && mkdir -p dist/dashboard && cp -R ../../apps/dashboard/out/. dist/dashboard/",

12 "audit-session-data": "node --import tsx scripts/audit-session-data.ts",

13 "maintain:semantic-reliability": "node --import tsx scripts/semantic-reliability-maintenance.ts",

14 "build:watch": "tsup --watch",

15 "clean": "rm -rf dist",

16 "postbuild": "cp ../../apps/server/public/fallback.html dist/fallback.html && node --import tsx scripts/bundle-plugin.ts",

17 "prepack": "npm run build && npm run bundle:dashboard",

18 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 },

20 "dependencies": {

21 "@colbymchenry/codegraph": "^1.1.1",

22 "@devflow-tools/adapters": "0.18.25",

23 "@devflow-tools/benchmark": "0.18.25",

24 "@devflow-tools/context-engine": "0.18.25",

25 "@devflow-tools/database": "0.18.25",

26 "@devflow-tools/delivery-line": "0.18.25",

27 "@devflow-tools/knowledge-engine": "0.18.25",

28 "@devflow-tools/mcp-server": "0.18.25",

29 "@devflow-tools/memory-engine": "0.18.25",

30 "@devflow-tools/retrieval-engine": "0.18.25",

31 "@devflow-tools/sdk": "0.18.25",

32 "@devflow-tools/semantic-engine": "0.18.25",

33 "@devflow-tools/server": "0.18.25",

34 "@devflow-tools/task-runtime": "0.18.25",

35 "@devflow-tools/telemetry": "0.18.25",

36 "@devflow-tools/workflow-engine": "0.18.25",

37 "@inquirer/prompts": "^7.10.1",

38 "@modelcontextprotocol/sdk": "^1.30.0",

dist/plugin/dist/hooks/hook-daemon.jsView file

Lines 1-21javascript

1import {createServer,createConnection}from'net';import {createHash,randomUUID as randomUUID$1}from'node:crypto';import {execFileSync,spawn}from'node:child_process';import {dirname,join as join$1}from'path';import {mkdirSync,lstatSync,openSync,writeFileSync,fstatSync,closeSync,readFileSync,unlinkSync,existsSync

dist/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import {createRequire as createRequire$1,isBuiltin}from'node:module';import {join as join$1,resolve,basename,dirname as dirname$1,relative,sep,isAbsolute,extname}from'node:path';import {createRuntimeManager,resolveStableProjectIdentity,loadPlugins,getPluginInstallRoot,resolveProjectCapabilityProfile,stableRuntimeHash,readPersistedClaudeHookNode,resolveClaudeHookRuntime,verifyClaudeHookNativeRuntime,redactMcpInventory,readMcpInventory,checkMcpHealth,readCachedMcpHealth,DOCTOR_SCHEMA_VERSION,getLocalHmacSecret,createDefaultHostAdapterRegistry,acquireRuntimeHttpCircuit,registerRuntimeHttpSuccess, ...

3`)}var Co=D(()=>{});function xt(){let e=dirname$1(fileURLToPath(import.meta.url)),t=[join$1(e,"..","plugin-files"),join$1(e,"plugin"),join$1(e,"..","..","dist","plugin-files"),join$1(e,"..","..","..","..","plugins","claude-code")];for(let n of t)if(existsSync$1(join$1(n,".claude-plugin","plugin.json")))return n;throw new Error("Plugin files not found. Run `

scripts/postinstall.jsView file

Lines 1-22javascript

1// packages/devflow/scripts/postinstall.js

2//

3// Auto-configures .claude/hooks.json in the consuming project so that Claude

4// Code invokes the devflow PreToolUse hook on every tool call.

5//

6// This file is plain ESM JavaScript (not TypeScript) because it must run during

7// `npm install` before any build step has compiled the package.

8//

9// If anything goes wrong we log a warning and exit 0 — we must never break a

10// user's `npm install`.

dist/hooks/user-prompt-submit.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/hooks/user-prompt-submit.js#virtual:normalized:round1View on unpkg

dist/hooks/hook-daemon.jsView file

•matchType = normalized_sha256 matchedPackage = @devflow-tools/devflow@0.18.24 matchedPath = dist/hooks/hook-daemon.js matchedIdentity = npm:QGRldmZsb3ctdG9vbHMvZGV2Zmxvdw:0.18.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/hooks/hook-daemon.jsView on unpkg

dist/dashboard/_next/static/chunks/237-34a3fbfba7ff0de5.jsView file

•matchType = normalized_sha256 matchedPackage = @devflow-tools/devflow@0.18.24 matchedPath = dist/dashboard/_next/static/chunks/237-34a3fbfba7ff0de5.js matchedIdentity = npm:QGRldmZsb3ctdG9vbHMvZGV2Zmxvdw:0.18.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dashboard/_next/static/chunks/237-34a3fbfba7ff0de5.jsView on unpkg

dist/dashboard/_next/static/chunks/main-09803f06c26fe6d9.jsView file

•matchType = normalized_sha256 matchedPackage = @devflow-tools/devflow@0.18.24 matchedPath = dist/dashboard/_next/static/chunks/main-09803f06c26fe6d9.js matchedIdentity = npm:QGRldmZsb3ctdG9vbHMvZGV2Zmxvdw:0.18.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dashboard/_next/static/chunks/main-09803f06c26fe6d9.jsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/plugin/dist/hooks/hook-daemon.jsView file

1import {createServer,createConnection}from'net';import {createHash,randomUUID as randomUUID$1}from'node:crypto';import {execFileSync,spawn}from'node:child_process';import {dirname,... L2: `;rotateDiagnosticLogFile({path:n,maxBytes:50*1024*1024,maxFiles:5,incomingBytes:Buffer.byteLength(o)}),appendFileSync(n,o);}catch{}}function Ci(t){return new Promise(e=>setTimeout...

High

Child Process

Package source references child process execution.

dist/plugin/dist/hooks/hook-daemon.jsView on unpkg · L1

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin/dist/hooks/hook-daemon.jsView on unpkg

dist/cli.jsView file

241${S.green("\u2713")} ${n} deactivated and uninstalled`);}catch(o){console.error(` L242: ${S.red("\u2717")} Uninstallation failed: ${o.message}`),process.exitCode=1;}});});function Xt(e){let t=join(e,".devflow","config.json");if(existsSync(t))try{let n=readFileSync(t,"... L243: `));}let n=Xt(t);console.error(S.blue(`DevFlow init \u2014 mode: ${n}`));let{initProject:o,renderInitReport:r}=await Promise.resolve().then(()=>(Uo(),Wo)),s=await o(t,{force:e.forc...

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L241

1#!/usr/bin/env node L2: import {createRequire as createRequire$1,isBuiltin}from'node:module';import {join as join$1,resolve,basename,dirname as dirname$1,relative,sep,isAbsolute,extname}from'node:path';im... L3: `)}var Co=D(()=>{});function xt(){let e=dirname$1(fileURLToPath(import.meta.url)),t=[join$1(e,"..","plugin-files"),join$1(e,"plugin"),join$1(e,"..","..","dist","plugin-files"),join... ... L8: `);}function me(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Wi(e,t){let n=join$1(e,"package.json");if(!existsSync$1(n))return;let o=JSON.parse(readFileSync$1... L9: `)}var Mo,Yi,Uo=D(()=>{Ke();Mo=To.default??To,Yi=createRequire(import.meta.url);});var qo={};j(qo,{reviewPluginMemoryHints:()=>oa});async function oa(e,t,n={}){let o=n.isTTY??!!pro... L10: `,"utf-8"),rena

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L1

scripts/postinstall.jsView file

2Install-time AI-agent control hijack evidence: L2: // L3: // Auto-configures .claude/hooks.json in the consuming project so that Claude L4: // Code invokes the devflow PreToolUse hook on every tool call. ... L11: L12: import { writeFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs'; L13: import { join, dirname } from 'node:path'; ... L55: L56: const claudeDir = join(projectRoot, '.claude'); L57: const hooksFile = join(claudeDir, 'hooks.json'); ... L59: L60: // 1. Ensure .claude/ directory exists L61: if (!existsSync(claudeDir)) { Payload evidence from dist/plugin/dist/skills/devflow:animation/SKILL.md: L54: L55: 以下版本描述知识源，不代表目标项目版本；目标项目的 package.json 与 lockfile 证据始终优先。 L56: L57: - animation-docs: 2024 — https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_animations L58:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L2

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { writefilesync, existssync, mkdirsync, readfilesync } from 'node:fs'; import { join, dirname } from 'node:path'; import { fileurltopath } from 'node:url'; const tag = '[devflow]'; function findprojectroot() { let dir = process.cwd(); for (let i = 0; i < 10; i++) { const pkgjson = join(dir, 'package.json'); const nodemodules = join(dir, 'node_modules'); if (existssync(pkgjson) && existssync(nodemodules)) { return dir; } const parent = dirname(dir); if (parent === dir) break;

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/postinstall.jsView on unpkg

dist/hooks/user-prompt-submit.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/hooks/user-prompt-submit.js#virtual:normalized:round1View on unpkg

dist/hooks/hook-daemon.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/hooks/hook-daemon.jsView on unpkg

dist/dashboard/_next/static/chunks/237-34a3fbfba7ff0de5.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dashboard/_next/static/chunks/237-34a3fbfba7ff0de5.jsView on unpkg

dist/dashboard/_next/static/chunks/main-09803f06c26fe6d9.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dashboard/_next/static/chunks/main-09803f06c26fe6d9.jsView on unpkg

Findings

1 Critical10 High4 Medium5 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/plugin/dist/hooks/hook-daemon.js

HighShelldist/cli.js

HighSame File Env Network Executiondist/cli.js

HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/postinstall.js

HighSemantic Analysis Limiteddist/hooks/user-prompt-submit.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/hooks/hook-daemon.js

HighKnown Malware Source Similaritydist/plugin/dist/hooks/hook-daemon.js

HighKnown Malware Source Similaritydist/dashboard/_next/static/chunks/237-34a3fbfba7ff0de5.js

HighKnown Malware Source Similaritydist/dashboard/_next/static/chunks/main-09803f06c26fe6d9.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @devflow-tools/devflow@0.18.25.

See version security history for other recorded verdicts.

Review the evidence and your use of @devflow-tools/devflow@0.18.25 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-20 03:19:24.833Z (UTC).