Loading npm security reports…

moflo@4.12.6: AI-agent control-surface risk | LPM Firewall

registry / moflo / 4.12.6

moflo@4.12.6

MoFlo — AI agent orchestration for Claude Code. A standalone, opinionated toolkit with semantic memory, learned routing, gates, spells, and the /flo issue-execution skill.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates an existing consumer Claude Code control surface without an explicit setup command. It deploys launcher and hook-capable scripts from the package into the project.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm install of moflo in a project containing .claude

Impact

Unconsented installation/update of Claude Code session-start and hook control code.

Mechanism

Copies package scripts and helpers into consumer .claude directories

Policy narrative

During npm postinstall, the bootstrap checks for an existing consumer .claude directory and then copies a manifest-selected set of package scripts, including session-start-launcher.mjs and hook-related helpers, into that foreign Claude Code control surface. This occurs without the user invoking the package's setup command.

Rationale

The package has a concrete, unconsented postinstall path that writes broad AI-agent launcher and hook code into an existing project control surface. This meets the install-control-surface block boundary despite no observed exfiltration.

Evidence

package.jsonscripts/post-install-bootstrap.mjsscripts/post-install-notice.mjsbin/lib/shipped-scripts.json<project>/.claude/scripts/<project>/.claude/scripts/lib/<project>/.claude/scripts/migrations/<project>/.claude/helpers/<project>/.moflo/bootstrap-failed.json

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/prune-native-binaries.mjs && node scripts/post-install-notice.mjs && node scripts/post-install-bootstrap.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/prune-native-binaries.mjs && node scripts/post-install-notice.mjs && node scripts/post-install-bootstrap.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/cli/guidance/analyzer.jsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.10.29 matchedPath = dist/src/cli/guidance/analyzer.js matchedIdentity = npm:bW9mbG8:4.10.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/guidance/analyzer.jsView on unpkg

1284patternName = generic_password severity = medium line = 1284 matchedText = { type: ...' },

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/src/cli/guidance/analyzer.jsView on unpkg · L1284

2067patternName = generic_password severity = medium line = 2067 matchedText = { type: ...' },

Medium

Secret Pattern

Hardcoded password in dist/src/cli/guidance/analyzer.js

dist/src/cli/guidance/analyzer.jsView on unpkg · L2067

2043{ type: 'must-match-pattern', value: 'escape|validate|regex|filter', severity: 'major' }, L2044: { type: 'must-not-contain', value: 'eval(', severity: 'critical' }, L2045: ],

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/cli/guidance/analyzer.jsView on unpkg · L2043

bin/generate-code-map.mjsView file

30import { fileURLToPath } from 'url'; L31: import { execSync, execFileSync, spawn } from 'child_process'; L32: import { memoryDbPath, MOFLO_DIR, findProjectRoot } from './lib/moflo-paths.mjs';

High

Child Process

Package source references child process execution.

bin/generate-code-map.mjsView on unpkg · L30

bin/hooks.mjsView file

3* Cross-platform Claude Code hook runner L4: * Works on Windows (cmd/powershell) and Linux/WSL (bash) L5: *

High

Shell

Package source references shell execution.

bin/hooks.mjsView on unpkg · L3

bin/run-migrations.mjsView file

61try { L62: const mod = await import(url); L63: if (mod && typeof mod.run === 'function' && typeof mod.name === 'string') {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/run-migrations.mjsView on unpkg · L61

bin/lib/file-sync.mjsView file

1/** L2: * Shared file-sync helper for the launcher (#854 §3) and the postinstall

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/lib/file-sync.mjsView on unpkg · L1

dist/src/cli/services/daemon-service.jsView file

8* - Linux: systemd --user unit in ~/.config/systemd/user/ L9: * - Windows: Task Scheduler ONLOGON trigger via schtasks L10: */ ... L14: import { homedir } from 'os'; L15: import { execSync } from 'child_process'; L16: import { locateMofloCliBin } from './moflo-require.js'; ... L35: const resolvedRoot = resolve(projectRoot); L36: const platform = options.platform ?? process.platform; L37: const run = options.runCommand ?? execSyncRunner; ... L100: const slug = projectRootSlug(projectRoot); L101: return join(options.homeDir ?? homedir(), 'Library', 'LaunchAgents', `${PLIST_LABEL}.${slug}.plist`); L102: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/src/cli/services/daemon-service.jsView on unpkg · L8

bin/setup-project.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: const { generateclaudemd } = await import(moflointernalurl('dist/src/cli/init/claudemd-generator.js')); const { applyinjectionreplacement, computeinjectiondrift } = await import( moflointernalurl('dist/src/cli/services/claudemd-injection.js') ); const args = process.argv.slice(2); const updateonly = args.includes('--update'); const checkonly = args.includes('--check'); const claude_md_section = generateclaudemd({}).trimend(); function log(msg) { console.log(`[flo-setup] ${msg}`); } function findprojectroot() {

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/setup-project.mjsView on unpkg

dist/src/cli/update/executor.jsView file

62// Execute npm install L63: const installCmd = `npm install ${update.package}@${update.latestVersion} --save-exact`; L64: execSync(installCmd, { L65: encoding: 'utf-8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/update/executor.jsView on unpkg · L62

dist/src/cli/memory/migration.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/cli/memory/migration.jsView on unpkg

bin/lib/daemon-recycler.mjsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.10.29 matchedPath = bin/lib/daemon-recycler.mjs matchedIdentity = npm:bW9mbG8:4.10.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/daemon-recycler.mjsView on unpkg

bin/meditate-distill.mjsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.10.29 matchedPath = bin/meditate-distill.mjs matchedIdentity = npm:bW9mbG8:4.10.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/meditate-distill.mjsView on unpkg

bin/simplify-classify.cjsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.10.29 matchedPath = bin/simplify-classify.cjs matchedIdentity = npm:bW9mbG8:4.10.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/simplify-classify.cjsView on unpkg

bin/index-reference.mjsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.10.29 matchedPath = bin/index-reference.mjs matchedIdentity = npm:bW9mbG8:4.10.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/index-reference.mjsView on unpkg

Lines 2023-2063javascript

2023 },

2024 {

2025 id: 'refactor-consolidate-validators',

2026 description: 'Consolidate duplicate validation helpers',

2027 taskClass: 'refactor',

2028 prompt: 'Consolidate the duplicate assertion evaluation functions across analyzer and headless modules into a shared validation utility.',

2029 assertions: [

2030 { type: 'must-match-pattern', value: 'shared|common|util|helper', severity: 'major' },

2031 { type: 'must-contain', value: 'test', severity: 'major' },

2032 ],

2033 gatePatterns: [missingTestGate, destructiveGate, policyGate],

2034 },

2035 // ── Security (3 tasks) ────────────────────────────────────────────

2036 {

2037 id: 'security-cli-input-sanitize',

2038 description: 'Sanitize user input in CLI arguments',

2039 taskClass: 'security',

2040 prompt: 'Add input sanitization for all CLI arguments to prevent command injection. Never pass unsanitized user input to shell commands.',

2041 assertions: [

2042 { type: 'must-contain', value: 'sanitiz', severity: 'critical' },

2043 { type: 'must-match-pattern', value: 'escape|validate|regex|filter', severity: 'major' },

2044 { type: 'must-not-contain', value: 'eval(', severity: 'critical' },

2045 ],

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/cli/guidance/analyzer.jsView on unpkg · L2043

2046 gatePatterns: [destructiveGate, secretGate, policyGate],

2047 },

2048 {

2049 id: 'security-hmac-verification',

2050 description: 'Add HMAC verification to proof chain',

2051 taskClass: 'security',

2052 prompt: 'Implement HMAC-SHA256 verification for proof chain envelopes. Reject any envelope that fails signature verification.',

2053 assertions: [

2054 { type: 'must-match-pattern', value: 'hmac|sha256|verify|signature', severity: 'critical' },

2055 { type: 'must-contain', value: 'reject', severity: 'major' },

2056 ],

2057 gatePatterns: [secretGate, policyGate],

2058 },

2059 {

2060 id: 'security-secret-scanning',

2061 description: 'Implement secret scanning for committed files',

2062 taskClass: 'security',

2063 prompt: 'Build a secret scanner that detects hardcoded passwords, API keys, and credentials in staged files before commit.',