registry / Install hook abuse / @toothfairyai/tfcode
@toothfairyai/tfcode
**ToothFairyAI's AI coding agent** — a command-line interface that brings AI-powered coding assistance to your terminal with deep ToothFairyAI workspace integration.
This report shows the evidence for @toothfairyai/tfcode@2.5.11. 5 of 43 known versions are blocked or flagged. The newest version, 2.8.0, is flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe automatic lifecycle hook stages a mutable, unverified remote executable and alters the user's Python environment. The CLI explicitly executes the staged binary, creating a concrete remote payload delivery path.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
npm install runs the postinstall hook; invoking tfcode runs the installed binary.
Impact
A remote release can replace the executable delivered to users, while installation also modifies the user's Python environment.
Mechanism
Install-time remote binary staging and user-level Python package installation.
Attack narrative
On installation, package.json runs postinstall.mjs. That script asks a remote Gitea server for its latest release, downloads a platform archive with curl, extracts it, and writes an executable into bin/tfcode without a version pin or integrity verification. It also invokes pip with --user and --break-system-packages. When the user invokes tfcode, the launcher executes the staged binary. This gives the remote release publisher control over code delivered through an automatic lifecycle hook.
AI rationale
The automatic lifecycle hook stages a mutable, unverified remote executable and alters the user's Python environment. The CLI explicitly executes the staged binary, creating a concrete remote payload delivery path.
Evidence
package.jsonpostinstall.mjsbin/tfcode.jsbin/tfcodebin/appbin/computer$TMPDIR/tfcode-install-${process.pid}user Python site-packages
Network endpoints2
gitea.toothfairyai.com/api/v1/repos/ToothFairyAI/tf_code/releases/latestgitea.toothfairyai.com/ToothFairyAI/tf_code/releases/download/v${version}/${filename}
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package automatically runs postinstall.
- Postinstall requests the remote repository's latest release rather than the package version.
- It downloads and installs an unverified platform archive from that remote release.
- The downloaded binary is later selected and executed by the CLI launcher.
- Postinstall also changes the user's Python environment with pip and --break-system-packages.
Evidence against
- The checked-in Python configuration reads only named ToothFairyAI credentials when its configuration functions are invoked.
- No package source shown exfiltrates local files or environment values during postinstall.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpython/tf_sync/config.pyView file
•path = python/tf_sync/config.py
kind = build_helper
sizeBytes = 7012
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
python/tf_sync/config.pyView on unpkgFindings
4 High5 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritybin/tfcode.js
HighKnown Malware Source Similaritypostinstall.mjs
HighKnown Malware Source Fingerprint Signaturebin/tfcode.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperpython/tf_sync/config.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @toothfairyai/tfcode@2.5.11.
The versions list below shows the verdict for each recorded version.
- Avoid installing @toothfairyai/tfcode@2.5.11. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.