registry / Staged payload carrier / @toothfairyai/tfcode / 2.4.1-beta.0

@toothfairyai/tfcode@2.4.1-beta.0

**ToothFairyAI's AI coding agent** — a command-line interface that brings AI-powered coding assistance to your terminal with deep ToothFairyAI workspace integration.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is an automatic, unverified remote payload delivery path plus an unsolicited user-environment package installation. Static inspection does not establish credential theft or an AI-agent control-surface takeover, so the risk is suspicious rather than proven malware.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation with lifecycle scripts enabled

Impact

A compromised or changed release endpoint can supply a binary later run by tfcode; installation also changes the user's Python package environment.

Mechanism

Postinstall remote binary staging and automatic pip installation

AI rationale

Evidence

package.jsonpostinstall.mjsbin/tfcode.jsbin/tfcodebin/app

Network endpoints2

gitea.toothfairyai.com/api/v1/repos/ToothFairyAI/tf_code/releases/latestgitea.toothfairyai.com

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package runs postinstall automatically.
Postinstall queries a latest-release API then downloads an executable archive without a pinned version or integrity check.
Postinstall automatically installs Python packages into the user's Python environment with --break-system-packages.
The CLI later executes the installed binary with the caller's environment.

Evidence against

The inspected JavaScript does not harvest credentials or send environment values during installation.
No self-dependency, AI-agent configuration write, or reviewer-directed text was found in the inspected source.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 13.6 KB of source, external domains: toothfairyai.com

Source & flagged code

7 flagged

package.jsonView file

Lines 1-28json

2 "name": "@toothfairyai/tfcode",

3 "version": "2.4.1-beta.0",

4 "bin": {

5 "tfcode": "./bin/tfcode.js"

6 },

7 "scripts": {

8 "postinstall": "node ./postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L8

9 },

10 "license": "MIT",

11 "optionalDependencies": {

12 "@toothfairyai/tfcode-linux-arm64": "2.4.1-beta.0",

13 "@toothfairyai/tfcode-windows-x64": "2.4.1-beta.0",

14 "@toothfairyai/tfcode-linux-x64-baseline-musl": "2.4.1-beta.0",

15 "@toothfairyai/tfcode-darwin-x64-baseline": "2.4.1-beta.0",

16 "@toothfairyai/tfcode-linux-x64-musl": "2.4.1-beta.0",

17 "@toothfairyai/tfcode-windows-x64-baseline": "2.4.1-beta.0",

18 "@toothfairyai/tfcode-linux-arm64-musl": "2.4.1-beta.0",

19 "@toothfairyai/tfcode-windows-arm64": "2.4.1-beta.0",

20 "@toothfairyai/tfcode-linux-x64": "2.4.1-beta.0",

21 "@toothfairyai/tfcode-darwin-x64": "2.4.1-beta.0",

22 "@toothfairyai/tfcode-linux-x64-baseline": "2.4.1-beta.0",

23 "@toothfairyai/tfcode-darwin-arm64": "2.4.1-beta.0"

24 },

25 "engines": {

26 "node": ">=18"

27 },

28 "homepage": "https://toothfairyai.com/developers/tfcode",

python/tf_sync/config.pyView file

•path = python/tf_sync/config.py kind = build_helper sizeBytes = 7012 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/tf_sync/config.pyView on unpkg

bin/tfcode.jsView file

•matchType = normalized_sha256 matchedPackage = @toothfairyai/tfcode@2.2.6 matchedPath = bin/tfcode.js matchedIdentity = npm:QHRvb3RoZmFpcnlhaS90ZmNvZGU:2.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/tfcode.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 4a53b45520011c93 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @toothfairyai/tfcode@2.2.6 matchedPath = bin/tfcode.js matchedIdentity = npm:QHRvb3RoZmFpcnlhaS90ZmNvZGU:2.2.6 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/tfcode.jsView on unpkg

postinstall.mjsView file

•matchType = normalized_sha256 matchedPackage = @toothfairyai/tfcode@2.2.6 matchedPath = postinstall.mjs matchedIdentity = npm:QHRvb3RoZmFpcnlhaS90ZmNvZGU:2.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.mjsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @toothfairyai/tfcode@2.5.0 matchedIdentity = npm:QHRvb3RoZmFpcnlhaS90ZmNvZGU:2.5.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

postinstall.mjsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

python/tf_sync/config.pyView file

•path = python/tf_sync/config.py kind = build_helper sizeBytes = 7012 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/tf_sync/config.pyView on unpkg

Findings

5 High5 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritybin/tfcode.js

HighKnown Malware Source Similaritypostinstall.mjs

HighKnown Malware Source Fingerprint Signaturebin/tfcode.js

HighPrevious Version Dangerous Deltapostinstall.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperpython/tf_sync/config.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @toothfairyai/tfcode@2.4.1-beta.0.

See all versions of @toothfairyai/tfcode for other recorded verdicts.

Review the evidence and your use of @toothfairyai/tfcode@2.4.1-beta.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 02:23:32.369Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.