Loading npm security reports…

moflo@4.13.1: AI-agent control-surface risk | LPM Firewall

registry / moflo / 4.13.1

moflo@4.13.1

MoFlo — AI agent orchestration for Claude Code. A standalone, opinionated toolkit with semantic memory, learned routing, gates, spells, and the /flo issue-execution skill.

AI Security Review

scanned 11h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The npm postinstall bootstrap writes package scripts and helpers into an existing consumer .claude directory. This changes files used by the consumer’s AI-agent setup without an explicit setup command.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package in a project that already has a .claude directory.

Impact

Package-controlled files can replace or add scripts and helpers in the consumer’s agent control surface.

Mechanism

The postinstall bootstrap syncs shipped scripts into .claude/scripts and helpers into .claude/helpers.

Policy narrative

During npm installation, the package runs a postinstall bootstrap. If the consumer project has a .claude directory, the bootstrap syncs package scripts and helpers into .claude/scripts and .claude/helpers, including hook-related files listed in the shipped-file manifest. This is an automatic mutation of the consumer’s agent control surface.

AI rationale

The manifest activates the bootstrap during npm postinstall, and source shows it copying package-controlled hook scripts and helpers into an existing consumer .claude directory. That unconsented control-surface mutation supports blocking.

Evidence

package.jsonscripts/post-install-bootstrap.mjsbin/lib/shipped-scripts.json.claude/scripts/.claude/helpers/

Decision evidence

Source & flagged code

26 flagged

package.jsonView file

Lines 33-73json

33 "!**/__tests__/**",

34 ".claude/commands/**/*.md",

35 ".claude/agents/**/*.md",

36 ".claude/helpers/**",

37 ".claude/guidance/shipped/**",

38 ".claude/skills/**/*.md",

39 "!.claude/**/*.db",

40 "!.claude/**/*.map",

41 "README.md",

42 "LICENSE",

43 "retired-files.json",

44 "scripts/prune-native-binaries.mjs",

45 "scripts/post-install-notice.mjs",

46 "scripts/post-install-bootstrap.mjs"

47 ],

48 "scripts": {

49 "dev": "tsx watch src/cli/index.ts",

50 "prebuild": "node scripts/sync-version.mjs && node scripts/clean-dist.mjs",

51 "build": "tsc",

52 "prepublishOnly": "npm run build",

53 "postinstall": "node scripts/prune-native-binaries.mjs && node scripts/post-install-notice.mjs && node scripts/post-install-bootstrap.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 "test": "node scripts/test-runner.mjs",

55 "test:ui": "vitest --ui",

56 "test:smoke": "node harness/consumer-smoke/run.mjs",

57 "test:smoke:populated": "node harness/consumer-smoke/run-populated.mjs",

58 "bench": "vitest run --config vitest.bench.config.ts",

59 "lint": "eslint src/ bin/ .claude/scripts/ --max-warnings 0",

60 "security:audit": "npm audit --omit=dev --audit-level high",

61 "security:fix": "npm audit fix",

62 "version": "node scripts/sync-version.mjs && git add src/cli/version.ts",

63 "flo": "node bin/cli.js",

64 "generate:helpers": "node scripts/generate-embedded-helpers.mjs"

65 },

66 "dependencies": {

67 "@anush008/tokenizers": "^0.6.0",

68 "@modelcontextprotocol/sdk": "^1.30.0",

69 "js-yaml": "^5.2.0",

70 "lru-cache": "^11.3.5",

71 "onnxruntime-node": "^1.27.0",

72 "semver": "^7.7.4",

73 "tar": "^7.5.16",

dist/src/cli/guidance/analyzer.jsView file

Lines 1264-1304javascript

1264 { type: 'must-contain', value: 'build', severity: 'critical' },

1265 ],

1266 weight: 0.35,

1267 },

1268 {

bin/generate-code-map.mjsView file

Lines 10-50javascript

10 * 5. file: — ONE PER FILE with exported types (file-level granularity)

11 *

12 * The `file:` entries are the key improvement — they enable precise semantic search

bin/hooks.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2/**

3 * Cross-platform Claude Code hook runner

4 * Works on Windows (cmd/powershell) and Linux/WSL (bash)

5 *

High

Shell

Package source references shell execution.

bin/hooks.mjsView on unpkg · L3

6 * Usage: node .claude/scripts/hooks.mjs <hook-type> [args...]

7 *

8 * Hook types:

9 * pre-edit --file <path>

bin/run-migrations.mjsView file

Lines 41-81javascript

41 const manifest = listMigrations(projectRoot);

42 const keys = Object.keys(manifest);

43 if (keys.length === 0

bin/lib/file-sync.mjsView file

Lines 1-21javascript

1/**

2 * Shared file-sync helper for the launcher (#854 §3) and the postinstall

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/lib/file-sync.mjsView on unpkg · L1

3 * bootstrap (#857 / #975).

4 *

5 * Both layers used to inline the same retry/breaker + copy logic. They drifted

6 * once already (the bootstrap added hash-skip + atomic tmp+rename for #975

7 * while the launcher kept the bare copyFileSync), so this module is the single

8 * source of truth.

dist/src/cli/services/daemon-service.jsView file

Lines 1-28javascript

1/**

2 * OS-Native Daemon Service Registration

3 *

4 * Registers/removes the moflo daemon as a user-level login service

5 * so scheduled spells survive reboots without Docker.

6 *

7 * - macOS: launchd plist in ~/Library/LaunchAgents/

8 * - Linux: systemd --user unit in ~/.config/systemd/user/

9 * - Windows: Task Scheduler ONLOGON trigger via schtasks

10 */

bin/setup-project.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: const { generateclaudemd } = await import(moflointernalurl('dist/src/cli/init/claudemd-generator.js')); const { applyinjectionreplacement, computeinjectiondrift } = await import( moflointernalurl('dist/src/cli/services/claudemd-injection.js') ); const args = process.argv.slice(2); const updateonly = args.includes('--update'); const checkonly = args.includes('--check'); const claude_md_section = generateclaudemd({}).trimend(); function log(msg) { console.log(`[flo-setup] ${msg}`); } function findprojectroot() {

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/setup-project.mjsView on unpkg

dist/src/cli/init/moflo-init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const strippedattribution = removelegacyattribution(existing); const canonical = generatesettings({ ...default_init_options, targetdir: root, force: true }); const scaffoldkeys = ['statusline', 'permissions', 'env']; const scaffoldadded = []; for (const key of scaffoldkeys) { if (existing[key] == null && canonical[key] != null) {

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/cli/init/moflo-init.jsView on unpkg

dist/src/cli/update/executor.jsView file

62// Execute npm install L63: const installCmd = `npm install ${update.package}@${update.latestVersion} --save-exact`; L64: execSync(installCmd, { L65: encoding: 'utf-8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/update/executor.jsView on unpkg · L62

bin/index-tests.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 33

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/index-tests.mjs#virtual:normalized:round1View on unpkg

dist/src/cli/commands/doctor-checks-runtime.jsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.13.2 matchedPath = dist/src/cli/commands/doctor-checks-runtime.js matchedIdentity = npm:bW9mbG8:4.13.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/doctor-checks-runtime.jsView on unpkg

dist/src/cli/index.jsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.13.2 matchedPath = dist/src/cli/index.js matchedIdentity = npm:bW9mbG8:4.13.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/index.jsView on unpkg

dist/src/cli/init/executor.jsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.13.2 matchedPath = dist/src/cli/init/executor.js matchedIdentity = npm:bW9mbG8:4.13.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/init/executor.jsView on unpkg

dist/src/cli/services/daemon-lock.jsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.13.2 matchedPath = dist/src/cli/services/daemon-lock.js matchedIdentity = npm:bW9mbG8:4.13.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/services/daemon-lock.jsView on unpkg

dist/src/cli/services/daemon-readiness.jsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.13.2 matchedPath = dist/src/cli/services/daemon-readiness.js matchedIdentity = npm:bW9mbG8:4.13.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/services/daemon-readiness.jsView on unpkg

dist/src/cli/spells/core/platform-sandbox.jsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.13.2 matchedPath = [redacted]-sandbox.js matchedIdentity = npm:bW9mbG8:4.13.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/spells/core/platform-sandbox.jsView on unpkg

bin/index-tests.mjsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.13.2 matchedPath = bin/index-tests.mjs matchedIdentity = npm:bW9mbG8:4.13.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/index-tests.mjsView on unpkg

dist/src/cli/commands/epic.jsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.13.2 matchedPath = dist/src/cli/commands/epic.js matchedIdentity = npm:bW9mbG8:4.13.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/epic.jsView on unpkg

dist/src/cli/commands/memory-audit-learnings.jsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.13.2 matchedPath = dist/src/cli/commands/memory-audit-learnings.js matchedIdentity = npm:bW9mbG8:4.13.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/memory-audit-learnings.jsView on unpkg

dist/src/cli/services/headless-worker-executor.jsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.13.2 matchedPath = dist/src/cli/services/headless-worker-executor.js matchedIdentity = npm:bW9mbG8:4.13.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/services/headless-worker-executor.jsView on unpkg

dist/src/cli/spells/commands/bash-command.jsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.13.2 matchedPath = [redacted]-command.js matchedIdentity = npm:bW9mbG8:4.13.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/spells/commands/bash-command.jsView on unpkg

dist/src/cli/spells/core/prerequisite-checker.jsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.13.2 matchedPath = [redacted]-checker.js matchedIdentity = npm:bW9mbG8:4.13.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/spells/core/prerequisite-checker.jsView on unpkg

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/prune-native-binaries.mjs && node scripts/post-install-notice.mjs && node scripts/post-install-bootstrap.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/prune-native-binaries.mjs && node scripts/post-install-notice.mjs && node scripts/post-install-bootstrap.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/cli/guidance/analyzer.jsView file

1284patternName = generic_password severity = medium line = 1284

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/src/cli/guidance/analyzer.jsView on unpkg · L1284

2067patternName = generic_password severity = medium line = 2067

Medium

Secret Pattern

Hardcoded password in dist/src/cli/guidance/analyzer.js

dist/src/cli/guidance/analyzer.jsView on unpkg · L2067

bin/generate-code-map.mjsView file

30import { fileURLToPath } from 'url'; L31: import { execSync, execFileSync, spawn } from 'child_process'; L32: import { memoryDbPath, MOFLO_DIR, findProjectRoot } from './lib/moflo-paths.mjs';

High

Child Process

Package source references child process execution.

bin/generate-code-map.mjsView on unpkg · L30

bin/hooks.mjsView file

3* Cross-platform Claude Code hook runner L4: * Works on Windows (cmd/powershell) and Linux/WSL (bash) L5: *

High

Shell

Package source references shell execution.

bin/hooks.mjsView on unpkg · L3

bin/run-migrations.mjsView file

61try { L62: const mod = await import(url); L63: if (mod && typeof mod.run === 'function' && typeof mod.name === 'string') {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/run-migrations.mjsView on unpkg · L61

bin/lib/file-sync.mjsView file

1/** L2: * Shared file-sync helper for the launcher (#854 §3) and the postinstall

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/lib/file-sync.mjsView on unpkg · L1

dist/src/cli/services/daemon-service.jsView file

8Trigger-reachable persistence chain: manifest.main -> dist/src/cli/index.js -> dist/src/cli/commands/index.js -> dist/src/cli/commands/daemon.js -> dist/src/cli/services/daemon-service.js L8: * - Linux: systemd --user unit in ~/.config/systemd/user/ L9: * - Windows: Task Scheduler ONLOGON trigger via schtasks L10: */ ... L14: import { homedir } from 'os'; L15: import { execSync } from 'child_process'; L16: import { locateMofloCliBin } from './moflo-require.js'; ... L35: const resolvedRoot = resolve(projectRoot); L36: const platform = options.platform ?? process.platform; L37: const run = options.runCommand ?? execSyncRunner; ... L100: const slug = projectRootSlug(projectRoot); L101: return join(options.homeDir ?? homedir(), 'Library', 'LaunchAgents', `${PLIST_LABEL}.${slug}.plist`); L102

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/src/cli/services/daemon-service.jsView on unpkg · L8

8* - Linux: systemd --user unit in ~/.config/systemd/user/ L9: * - Windows: Task Scheduler ONLOGON trigger via schtasks L10: */ ... L14: import { homedir } from 'os'; L15: import { execSync } from 'child_process'; L16: import { locateMofloCliBin } from './moflo-require.js'; ... L35: const resolvedRoot = resolve(projectRoot); L36: const platform = options.platform ?? process.platform; L37: const run = options.runCommand ?? execSyncRunner; ... L100: const slug = projectRootSlug(projectRoot); L101: return join(options.homeDir ?? homedir(), 'Library', 'LaunchAgents', `${PLIST_LABEL}.${slug}.plist`); L102: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/src/cli/services/daemon-service.jsView on unpkg · L8

bin/setup-project.mjsView file

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/setup-project.mjsView on unpkg

dist/src/cli/init/moflo-init.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/cli/init/moflo-init.jsView on unpkg

dist/src/cli/update/executor.jsView file

62// Execute npm install L63: const installCmd = `npm install ${update.package}@${update.latestVersion} --save-exact`; L64: execSync(installCmd, { L65: encoding: 'utf-8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/update/executor.jsView on unpkg · L62

bin/index-tests.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 33

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/index-tests.mjs#virtual:normalized:round1View on unpkg

dist/src/cli/commands/doctor-checks-runtime.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/doctor-checks-runtime.jsView on unpkg

dist/src/cli/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/index.jsView on unpkg

dist/src/cli/init/executor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/init/executor.jsView on unpkg

dist/src/cli/services/daemon-lock.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/services/daemon-lock.jsView on unpkg

dist/src/cli/services/daemon-readiness.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/services/daemon-readiness.jsView on unpkg

dist/src/cli/spells/core/platform-sandbox.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/spells/core/platform-sandbox.jsView on unpkg

bin/index-tests.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/index-tests.mjsView on unpkg

dist/src/cli/commands/epic.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/epic.jsView on unpkg

dist/src/cli/commands/memory-audit-learnings.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/memory-audit-learnings.jsView on unpkg

dist/src/cli/services/headless-worker-executor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/services/headless-worker-executor.jsView on unpkg

dist/src/cli/spells/commands/bash-command.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/spells/commands/bash-command.jsView on unpkg

dist/src/cli/spells/core/prerequisite-checker.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/spells/core/prerequisite-checker.jsView on unpkg

Source & flagged code

26 flagged

package.jsonView file

Lines 33-73json

33 "!**/__tests__/**",

34 ".claude/commands/**/*.md",

35 ".claude/agents/**/*.md",

36 ".claude/helpers/**",

37 ".claude/guidance/shipped/**",

38 ".claude/skills/**/*.md",

39 "!.claude/**/*.db",

40 "!.claude/**/*.map",

41 "README.md",

42 "LICENSE",

43 "retired-files.json",

44 "scripts/prune-native-binaries.mjs",

45 "scripts/post-install-notice.mjs",

46 "scripts/post-install-bootstrap.mjs"

47 ],

48 "scripts": {

49 "dev": "tsx watch src/cli/index.ts",

50 "prebuild": "node scripts/sync-version.mjs && node scripts/clean-dist.mjs",

51 "build": "tsc",

52 "prepublishOnly": "npm run build",

53 "postinstall": "node scripts/prune-native-binaries.mjs && node scripts/post-install-notice.mjs && node scripts/post-install-bootstrap.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 "test": "node scripts/test-runner.mjs",

55 "test:ui": "vitest --ui",

56 "test:smoke": "node harness/consumer-smoke/run.mjs",

57 "test:smoke:populated": "node harness/consumer-smoke/run-populated.mjs",

58 "bench": "vitest run --config vitest.bench.config.ts",

59 "lint": "eslint src/ bin/ .claude/scripts/ --max-warnings 0",

60 "security:audit": "npm audit --omit=dev --audit-level high",

61 "security:fix": "npm audit fix",

62 "version": "node scripts/sync-version.mjs && git add src/cli/version.ts",

63 "flo": "node bin/cli.js",

64 "generate:helpers": "node scripts/generate-embedded-helpers.mjs"

65 },

66 "dependencies": {

67 "@anush008/tokenizers": "^0.6.0",

68 "@modelcontextprotocol/sdk": "^1.30.0",

69 "js-yaml": "^5.2.0",

70 "lru-cache": "^11.3.5",

71 "onnxruntime-node": "^1.27.0",

72 "semver": "^7.7.4",

73 "tar": "^7.5.16",

dist/src/cli/guidance/analyzer.jsView file

Lines 1264-1304javascript

1264 { type: 'must-contain', value: 'build', severity: 'critical' },

1265 ],

1266 weight: 0.35,

1267 },

1268 {

bin/generate-code-map.mjsView file

Lines 10-50javascript

10 * 5. file: — ONE PER FILE with exported types (file-level granularity)

11 *

12 * The `file:` entries are the key improvement — they enable precise semantic search

bin/hooks.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2/**

3 * Cross-platform Claude Code hook runner

4 * Works on Windows (cmd/powershell) and Linux/WSL (bash)

5 *

High

Shell

Package source references shell execution.

bin/hooks.mjsView on unpkg · L3

6 * Usage: node .claude/scripts/hooks.mjs <hook-type> [args...]

7 *

8 * Hook types:

9 * pre-edit --file <path>

bin/run-migrations.mjsView file

Lines 41-81javascript

41 const manifest = listMigrations(projectRoot);

42 const keys = Object.keys(manifest);

43 if (keys.length === 0

bin/lib/file-sync.mjsView file

Lines 1-21javascript

1/**

2 * Shared file-sync helper for the launcher (#854 §3) and the postinstall

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/lib/file-sync.mjsView on unpkg · L1

3 * bootstrap (#857 / #975).

4 *

5 * Both layers used to inline the same retry/breaker + copy logic. They drifted

6 * once already (the bootstrap added hash-skip + atomic tmp+rename for #975

7 * while the launcher kept the bare copyFileSync), so this module is the single

8 * source of truth.

dist/src/cli/services/daemon-service.jsView file

Lines 1-28javascript

1/**

2 * OS-Native Daemon Service Registration

3 *

4 * Registers/removes the moflo daemon as a user-level login service

5 * so scheduled spells survive reboots without Docker.

6 *

7 * - macOS: launchd plist in ~/Library/LaunchAgents/

8 * - Linux: systemd --user unit in ~/.config/systemd/user/

9 * - Windows: Task Scheduler ONLOGON trigger via schtasks

10 */

bin/setup-project.mjsView file

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/setup-project.mjsView on unpkg

dist/src/cli/init/moflo-init.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/cli/init/moflo-init.jsView on unpkg

dist/src/cli/update/executor.jsView file

62// Execute npm install L63: const installCmd = `npm install ${update.package}@${update.latestVersion} --save-exact`; L64: execSync(installCmd, { L65: encoding: 'utf-8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/update/executor.jsView on unpkg · L62

bin/index-tests.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 33

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/index-tests.mjs#virtual:normalized:round1View on unpkg

dist/src/cli/commands/doctor-checks-runtime.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/doctor-checks-runtime.jsView on unpkg

dist/src/cli/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/index.jsView on unpkg

dist/src/cli/init/executor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/init/executor.jsView on unpkg

dist/src/cli/services/daemon-lock.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/services/daemon-lock.jsView on unpkg

dist/src/cli/services/daemon-readiness.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/services/daemon-readiness.jsView on unpkg

dist/src/cli/spells/core/platform-sandbox.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/spells/core/platform-sandbox.jsView on unpkg

bin/index-tests.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/index-tests.mjsView on unpkg

dist/src/cli/commands/epic.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/epic.jsView on unpkg

dist/src/cli/commands/memory-audit-learnings.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/memory-audit-learnings.jsView on unpkg

dist/src/cli/services/headless-worker-executor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/services/headless-worker-executor.jsView on unpkg

dist/src/cli/spells/commands/bash-command.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/spells/commands/bash-command.jsView on unpkg

dist/src/cli/spells/core/prerequisite-checker.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/spells/core/prerequisite-checker.jsView on unpkg

moflo@4.13.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code