@toothfairyai/tfcode@2.5.17
**ToothFairyAI's AI coding agent** — a command-line interface that brings AI-powered coding assistance to your terminal with deep ToothFairyAI workspace integration.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe package has a concrete automatic remote-payload staging path and an unprompted user-level Python installation. These are material supply-chain risks, but source inspection does not prove an active malicious payload or attack.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
npm installation runs postinstall; later, a user runs the tfcode command.
Impact
A compromised or changed release artifact could execute on later CLI use, and installation mutates the user's Python environment. No confirmed active attack surface was established from this source alone.
Mechanism
The hook fetches release metadata, downloads and extracts a platform archive, and invokes pip for user-level dependencies. The launcher spawns the selected binary with the caller's environment.
AI rationale
The package has a concrete automatic remote-payload staging path and an unprompted user-level Python installation. These are material supply-chain risks, but source inspection does not prove an active malicious payload or attack.
Evidence
package.jsonpostinstall.mjsbin/tfcode.jsbin/tfcodebin/app
Network endpoints1
gitea.toothfairyai.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package automatically runs its postinstall script.
- The install script queries the latest release and constructs a remote archive download URL.
- The installer downloads an archive into its installation directory without shown integrity verification; the CLI later spawns its selected binary.
- The install script also automatically invokes pip to install user-level Python packages with a system-package override.
Evidence against
- The default download host and repository are package-aligned.
- No credential collection, data exfiltration, AI-agent configuration changes, or destructive actions were found in the inspected entrypoints.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpython/tf_sync/config.pyView file
•path = python/tf_sync/config.py
kind = build_helper
sizeBytes = 7012
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
python/tf_sync/config.pyView on unpkgFindings
4 High5 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritybin/tfcode.js
HighKnown Malware Source Similaritypostinstall.mjs
HighKnown Malware Source Fingerprint Signaturebin/tfcode.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperpython/tf_sync/config.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @toothfairyai/tfcode@2.5.17.
See all versions of @toothfairyai/tfcode for other recorded verdicts.
- Review the evidence and your use of @toothfairyai/tfcode@2.5.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.