registry / @toothfairyai/tfcode / 1.9.7

@toothfairyai/tfcode@1.9.7

**ToothFairyAI's AI coding agent** — a command-line interface that brings AI-powered coding assistance to your terminal with deep ToothFairyAI workspace integration.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Installation fetches a mutable latest release archive and stages its native binary without a source-visible integrity check. The binary is later run by the tfcode command.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall on a platform lacking bin/tfcode; later explicit tfcode invocation.

Impact

A compromised or changed release endpoint can replace the executable subsequently launched by the CLI.

Mechanism

remote native-payload staging via unpinned release download

Rationale

Source establishes a postinstall-time mutable remote binary staging path and a user-level pip mutation, warranting a warning. It does not establish concrete malicious behavior, exfiltration, or broad AI-agent control-surface modification.

Evidence

package.jsonpostinstall.mjsbin/tfcode.jspython/tf_sync/config.pybin/tfcodebin/app

Network endpoints2

gitea.toothfairyai.com/api/v1/repos/ToothFairyAI/tf_code/releases/latestgitea.toothfairyai.com/ToothFairyAI/tf_code/releases/download/

Decision evidence

public snapshot

@toothfairyai/tfcode@1.9.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code