Loading npm security reports…

moflo@4.12.11: AI-agent control-surface risk | LPM Firewall

registry / moflo / 4.12.11

moflo@4.12.11

MoFlo — AI agent orchestration for Claude Code. A standalone, opinionated toolkit with semantic memory, learned routing, gates, spells, and the /flo issue-execution skill.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates an existing project's .claude control surface without an explicit setup command. It installs hook and session-launcher code that can execute package CLI actions in Claude sessions.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm install moflo in any project containing .claude

Impact

Unconsented persistence and execution in the project's Claude Code hook/control surface.

Mechanism

postinstall copies package-controlled hooks, launchers, and helpers into .claude

Policy narrative

Installing the package runs postinstall. If the consumer project merely contains .claude, bootstrap creates and overwrites .claude scripts, migrations, and helpers from the package manifest, including hooks.mjs and a session-start launcher. Those installed hooks read Claude tool-input environment values and invoke the package CLI. This is an unconsented install-time mutation of a foreign AI-agent control surface, not an explicit user setup action.

Rationale

Source confirms the concrete postinstall control-surface mutation. The .claude-exists check is not a package-ownership or explicit-consent gate.

Evidence

package.jsonscripts/post-install-bootstrap.mjsbin/lib/shipped-scripts.jsonbin/hooks.mjs.claude/scripts/*.claude/scripts/lib/*.claude/scripts/migrations/*.claude/helpers/*.moflo/bootstrap-failed.json

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/prune-native-binaries.mjs && node scripts/post-install-notice.mjs && node scripts/post-install-bootstrap.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/prune-native-binaries.mjs && node scripts/post-install-notice.mjs && node scripts/post-install-bootstrap.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/cli/guidance/analyzer.jsView file

1284patternName = generic_password severity = medium line = 1284 matchedText = { type: ...' },

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/src/cli/guidance/analyzer.jsView on unpkg · L1284

2067patternName = generic_password severity = medium line = 2067 matchedText = { type: ...' },

Medium

Secret Pattern

Hardcoded password in dist/src/cli/guidance/analyzer.js

dist/src/cli/guidance/analyzer.jsView on unpkg · L2067

2043{ type: 'must-match-pattern', value: 'escape|validate|regex|filter', severity: 'major' }, L2044: { type: 'must-not-contain', value: 'eval(', severity: 'critical' }, L2045: ],

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/cli/guidance/analyzer.jsView on unpkg · L2043

bin/generate-code-map.mjsView file

30import { fileURLToPath } from 'url'; L31: import { execSync, execFileSync, spawn } from 'child_process'; L32: import { memoryDbPath, MOFLO_DIR, findProjectRoot } from './lib/moflo-paths.mjs';

High

Child Process

Package source references child process execution.

bin/generate-code-map.mjsView on unpkg · L30

bin/hooks.mjsView file

3* Cross-platform Claude Code hook runner L4: * Works on Windows (cmd/powershell) and Linux/WSL (bash) L5: *

High

Shell

Package source references shell execution.

bin/hooks.mjsView on unpkg · L3

•matchType = normalized_sha256 matchedPackage = moflo@4.12.5 matchedPath = bin/hooks.mjs matchedIdentity = npm:bW9mbG8:4.12.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/hooks.mjsView on unpkg

bin/run-migrations.mjsView file

61try { L62: const mod = await import(url); L63: if (mod && typeof mod.run === 'function' && typeof mod.name === 'string') {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/run-migrations.mjsView on unpkg · L61

bin/lib/file-sync.mjsView file

1/** L2: * Shared file-sync helper for the launcher (#854 §3) and the postinstall

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/lib/file-sync.mjsView on unpkg · L1

dist/src/cli/services/daemon-service.jsView file

8* - Linux: systemd --user unit in ~/.config/systemd/user/ L9: * - Windows: Task Scheduler ONLOGON trigger via schtasks L10: */ ... L14: import { homedir } from 'os'; L15: import { execSync } from 'child_process'; L16: import { locateMofloCliBin } from './moflo-require.js'; ... L35: const resolvedRoot = resolve(projectRoot); L36: const platform = options.platform ?? process.platform; L37: const run = options.runCommand ?? execSyncRunner; ... L100: const slug = projectRootSlug(projectRoot); L101: return join(options.homeDir ?? homedir(), 'Library', 'LaunchAgents', `${PLIST_LABEL}.${slug}.plist`); L102: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/src/cli/services/daemon-service.jsView on unpkg · L8

bin/setup-project.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: const { generateclaudemd } = await import(moflointernalurl('dist/src/cli/init/claudemd-generator.js')); const { applyinjectionreplacement, computeinjectiondrift } = await import( moflointernalurl('dist/src/cli/services/claudemd-injection.js') ); const args = process.argv.slice(2); const updateonly = args.includes('--update'); const checkonly = args.includes('--check'); const claude_md_section = generateclaudemd({}).trimend(); function log(msg) { console.log(`[flo-setup] ${msg}`); } function findprojectroot() {

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/setup-project.mjsView on unpkg

dist/src/cli/update/executor.jsView file

62// Execute npm install L63: const installCmd = `npm install ${update.package}@${update.latestVersion} --save-exact`; L64: execSync(installCmd, { L65: encoding: 'utf-8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/update/executor.jsView on unpkg · L62

dist/src/cli/memory/migration.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/cli/memory/migration.jsView on unpkg

bin/index-tests.mjsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.12.5 matchedPath = bin/index-tests.mjs matchedIdentity = npm:bW9mbG8:4.12.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/index-tests.mjsView on unpkg

bin/lib/daemon-recycler.mjsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.12.5 matchedPath = bin/lib/daemon-recycler.mjs matchedIdentity = npm:bW9mbG8:4.12.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/daemon-recycler.mjsView on unpkg

bin/lib/process-manager.mjsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.12.5 matchedPath = bin/lib/process-manager.mjs matchedIdentity = npm:bW9mbG8:4.12.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/process-manager.mjsView on unpkg

dist/src/cli/index.jsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.12.5 matchedPath = dist/src/cli/index.js matchedIdentity = npm:bW9mbG8:4.12.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/index.jsView on unpkg

Lines 2023-2063javascript

2023 },

2024 {

2025 id: 'refactor-consolidate-validators',

2026 description: 'Consolidate duplicate validation helpers',

2027 taskClass: 'refactor',

2028 prompt: 'Consolidate the duplicate assertion evaluation functions across analyzer and headless modules into a shared validation utility.',

2029 assertions: [

2030 { type: 'must-match-pattern', value: 'shared|common|util|helper', severity: 'major' },

2031 { type: 'must-contain', value: 'test', severity: 'major' },

2032 ],

2033 gatePatterns: [missingTestGate, destructiveGate, policyGate],

2034 },

2035 // ── Security (3 tasks) ────────────────────────────────────────────

2036 {

2037 id: 'security-cli-input-sanitize',

2038 description: 'Sanitize user input in CLI arguments',

2039 taskClass: 'security',

2040 prompt: 'Add input sanitization for all CLI arguments to prevent command injection. Never pass unsanitized user input to shell commands.',

2041 assertions: [

2042 { type: 'must-contain', value: 'sanitiz', severity: 'critical' },

2043 { type: 'must-match-pattern', value: 'escape|validate|regex|filter', severity: 'major' },

2044 { type: 'must-not-contain', value: 'eval(', severity: 'critical' },

2045 ],

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/cli/guidance/analyzer.jsView on unpkg · L2043

2046 gatePatterns: [destructiveGate, secretGate, policyGate],

2047 },

2048 {

2049 id: 'security-hmac-verification',

2050 description: 'Add HMAC verification to proof chain',

2051 taskClass: 'security',

2052 prompt: 'Implement HMAC-SHA256 verification for proof chain envelopes. Reject any envelope that fails signature verification.',

2053 assertions: [

2054 { type: 'must-match-pattern', value: 'hmac|sha256|verify|signature', severity: 'critical' },

2055 { type: 'must-contain', value: 'reject', severity: 'major' },

2056 ],

2057 gatePatterns: [secretGate, policyGate],

2058 },

2059 {

2060 id: 'security-secret-scanning',

2061 description: 'Implement secret scanning for committed files',

2062 taskClass: 'security',

2063 prompt: 'Build a secret scanner that detects hardcoded passwords, API keys, and credentials in staged files before commit.',