registry / Install hook abuse / @toothfairyai/tfcode / 2.5.5

@toothfairyai/tfcode@2.5.5

**ToothFairyAI's AI coding agent** — a command-line interface that brings AI-powered coding assistance to your terminal with deep ToothFairyAI workspace integration.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The lifecycle hook performs automatic, unverified remote payload acquisition and mutates a user-level Python environment. This is a concrete unresolved install-time supply-chain risk, but the inspected source lacks the broader malicious chain required for a block.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm installation with lifecycle scripts enabled

Impact

A compromised release host or Python package supply chain could place attacker-controlled code in the local installation environment.

Mechanism

Postinstall remote binary retrieval and user-level pip installation

AI rationale

Evidence

package.jsonpostinstall.mjsbin/tfcodebin/app$TMPDIR/tfcode-install-<pid>user Python environment

Network endpoints1

gitea.toothfairyai.com

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The npm postinstall hook runs automatically on installation.
The hook fetches the latest release version and downloads an unsigned platform archive from a network host that can be changed through an environment variable.
The hook automatically invokes pip with --user and --break-system-packages, changing the installing user's Python environment.

Evidence against

No package self-dependency is declared.
The downloaded binary is installed but not executed by the postinstall script.
The Python source uses explicitly supplied ToothFairyAI credentials for its stated API client; no credential harvesting code was found.
No code writes broad AI-agent configuration or foreign project control surfaces.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

5 flagged

package.jsonView file

Lines 1-28json

2 "name": "@toothfairyai/tfcode",

3 "version": "2.5.5",

4 "bin": {

5 "tfcode": "./bin/tfcode.js"

6 },

7 "scripts": {

8 "postinstall": "node ./postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L8

9 },

Medium

Suspicious Lifecycle Evidence

The npm postinstall hook runs automatically on installation.

package.jsonView on unpkg · L7

10 "license": "MIT",

11 "optionalDependencies": {

12 "@toothfairyai/tfcode-linux-arm64": "2.5.5",

13 "@toothfairyai/tfcode-windows-x64": "2.5.5",

14 "@toothfairyai/tfcode-linux-x64-baseline-musl": "2.5.5",

15 "@toothfairyai/tfcode-darwin-x64-baseline": "2.5.5",

16 "@toothfairyai/tfcode-linux-x64-musl": "2.5.5",

17 "@toothfairyai/tfcode-windows-x64-baseline": "2.5.5",

18 "@toothfairyai/tfcode-linux-arm64-musl": "2.5.5",

19 "@toothfairyai/tfcode-windows-arm64": "2.5.5",

20 "@toothfairyai/tfcode-linux-x64": "2.5.5",

21 "@toothfairyai/tfcode-darwin-x64": "2.5.5",

22 "@toothfairyai/tfcode-linux-x64-baseline": "2.5.5",

23 "@toothfairyai/tfcode-darwin-arm64": "2.5.5"

24 },

25 "engines": {

26 "node": ">=18"

27 },

28 "homepage": "https://toothfairyai.com/developers/tfcode",

python/tf_sync/config.pyView file

•path = python/tf_sync/config.py kind = build_helper sizeBytes = 7012 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/tf_sync/config.pyView on unpkg

bin/tfcode.jsView file

•matchType = normalized_sha256 matchedPackage = @toothfairyai/tfcode@2.2.6 matchedPath = bin/tfcode.js matchedIdentity = npm:QHRvb3RoZmFpcnlhaS90ZmNvZGU:2.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/tfcode.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

7"scripts": { "postinstall": "node ./postinstall.mjs" },

Medium

Suspicious Lifecycle Evidence

The npm postinstall hook runs automatically on installation.

package.jsonView on unpkg · L7

python/tf_sync/config.pyView file

Findings

2 High6 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritybin/tfcode.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperpython/tf_sync/config.py

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @toothfairyai/tfcode@2.5.5.

See all versions of @toothfairyai/tfcode for other recorded verdicts.

Review the evidence and your use of @toothfairyai/tfcode@2.5.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-15 06:17:06.511Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.