registry / Install hook abuse / @toothfairyai/tfcode / 2.5.0

@toothfairyai/tfcode@2.5.0

**ToothFairyAI's AI coding agent** — a command-line interface that brings AI-powered coding assistance to your terminal with deep ToothFairyAI workspace integration.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is suspicious because an automatic lifecycle hook installs an unverified latest remote binary and modifies the user's Python environment. The code lacks direct evidence of credential exfiltration or a complete malicious lifecycle chain, so blocking is not justified.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation with lifecycle scripts enabled

Impact

A compromised or redirected release host can supply an executable; installation also changes the user's Python environment.

Mechanism

postinstall downloads a remote binary and installs user-level Python packages

AI rationale

Evidence

package.jsonpostinstall.mjsbin/tfcodebin/app

Network endpoints1

gitea.toothfairyai.com

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Installation automatically runs a postinstall program.
The postinstall program obtains the latest release version and downloads a platform archive from a host that can be overridden through environment variables.
The installer extracts and marks the downloaded binary executable, then automatically runs a user-level pip installation with a system-package override.

Evidence against

No self-dependency is declared; platform packages are fixed-version optional dependencies.
The inspected JavaScript does not harvest credentials or send local files to a remote endpoint.
The command-line wrapper only locates and launches the installed platform binary.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 15.4 KB of source, external domains: toothfairyai.com

Source & flagged code

5 flagged

package.jsonView file

Lines 1-28json

2 "name": "@toothfairyai/tfcode",

3 "version": "2.5.0",

4 "bin": {

5 "tfcode": "./bin/tfcode.js"

6 },

7 "scripts": {

8 "postinstall": "node ./postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L8

9 },

10 "license": "MIT",

11 "optionalDependencies": {

12 "@toothfairyai/tfcode-linux-arm64": "2.5.0",

13 "@toothfairyai/tfcode-windows-x64": "2.5.0",

14 "@toothfairyai/tfcode-linux-x64-baseline-musl": "2.5.0",

15 "@toothfairyai/tfcode-darwin-x64-baseline": "2.5.0",

16 "@toothfairyai/tfcode-linux-x64-musl": "2.5.0",

17 "@toothfairyai/tfcode-windows-x64-baseline": "2.5.0",

18 "@toothfairyai/tfcode-linux-arm64-musl": "2.5.0",

19 "@toothfairyai/tfcode-windows-arm64": "2.5.0",

20 "@toothfairyai/tfcode-linux-x64": "2.5.0",

21 "@toothfairyai/tfcode-darwin-x64": "2.5.0",

22 "@toothfairyai/tfcode-linux-x64-baseline": "2.5.0",

23 "@toothfairyai/tfcode-darwin-arm64": "2.5.0"

24 },

25 "engines": {

26 "node": ">=18"

27 },

28 "homepage": "https://toothfairyai.com/developers/tfcode",

python/tf_sync/config.pyView file

•path = python/tf_sync/config.py kind = build_helper sizeBytes = 7012 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/tf_sync/config.pyView on unpkg

bin/tfcode.jsView file

•matchType = normalized_sha256 matchedPackage = @toothfairyai/tfcode@2.2.6 matchedPath = bin/tfcode.js matchedIdentity = npm:QHRvb3RoZmFpcnlhaS90ZmNvZGU:2.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/tfcode.jsView on unpkg

postinstall.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @toothfairyai/tfcode@2.4.3 matchedIdentity = npm:QHRvb3RoZmFpcnlhaS90ZmNvZGU:2.4.3 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

postinstall.mjsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

python/tf_sync/config.pyView file

•path = python/tf_sync/config.py kind = build_helper sizeBytes = 7012 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/tf_sync/config.pyView on unpkg

Findings

3 High5 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritybin/tfcode.js

HighPrevious Version Dangerous Deltapostinstall.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperpython/tf_sync/config.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @toothfairyai/tfcode@2.5.0.

See all versions of @toothfairyai/tfcode for other recorded verdicts.

Review the evidence and your use of @toothfairyai/tfcode@2.5.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 02:11:51.369Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.