Loading npm security reports…

moflo@4.13.2: Malicious npm security report (Block) | LPM Firewall

registry / moflo / 4.13.2

moflo@4.13.2

MoFlo — AI agent orchestration for Claude Code. A standalone, opinionated toolkit with semantic memory, learned routing, gates, spells, and the /flo issue-execution skill.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

On npm installation in a project that already has .claude, the package automatically deposits package-controlled hook and launcher files into that AI-agent control surface. In a Claude session it also writes a message intended for Claude to relay.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall while the consumer project contains .claude; the notice path additionally requires a Claude-session environment variable.

Impact

Package code can persist as project-level Claude scripts and helpers without an explicit setup command, influencing later agent sessions.

Mechanism

Automatic copying of package-selected agent scripts and helpers into the consumer project.

Attack narrative

Installing the package runs postinstall automatically. If the consumer already has a .claude directory, the bootstrap creates or overwrites project .claude scripts, libraries, migrations, and helpers from a package-controlled manifest, including hook and prompt-related components. In Claude environments it also leaves a restart message for the agent. This is an unconsented lifecycle mutation of a broad project AI-agent control surface; later Claude sessions may execute or rely on the deposited files.

AI rationale

The install lifecycle performs broad project-level Claude control-surface mutation rather than limiting itself to package-owned files or an explicit setup command. No lifecycle exfiltration was found, but the automatic persistence is concrete and sufficient to block publication.

Evidence

package.jsonscripts/post-install-bootstrap.mjsbin/lib/shipped-scripts.jsonscripts/post-install-notice.mjs

Source & flagged code

22 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/prune-native-binaries.mjs && node scripts/post-install-notice.mjs && node scripts/post-install-bootstrap.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/prune-native-binaries.mjs && node scripts/post-install-notice.mjs && node scripts/post-install-bootstrap.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/cli/guidance/analyzer.jsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.12.11 matchedPath = dist/src/cli/guidance/analyzer.js matchedIdentity = npm:bW9mbG8:4.12.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/guidance/analyzer.jsView on unpkg

1284patternName = generic_password severity = medium line = 1284

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/src/cli/guidance/analyzer.jsView on unpkg · L1284

2067patternName = generic_password severity = medium line = 2067

Medium

Secret Pattern

Hardcoded password in dist/src/cli/guidance/analyzer.js

dist/src/cli/guidance/analyzer.jsView on unpkg · L2067

2043{ type: 'must-match-pattern', value: 'escape|validate|regex|filter', severity: 'major' }, L2044: { type: 'must-not-contain', value: 'eval(', severity: 'critical' }, L2045: ],

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/cli/guidance/analyzer.jsView on unpkg · L2043

bin/generate-code-map.mjsView file

30import { fileURLToPath } from 'url'; L31: import { execSync, execFileSync, spawn } from 'child_process'; L32: import { memoryDbPath, MOFLO_DIR, findProjectRoot } from './lib/moflo-paths.mjs';

High

Child Process

Package source references child process execution.

bin/generate-code-map.mjsView on unpkg · L30

•matchType = normalized_sha256 matchedPackage = moflo@4.12.11 matchedPath = bin/generate-code-map.mjs matchedIdentity = npm:bW9mbG8:4.12.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/generate-code-map.mjsView on unpkg

bin/hooks.mjsView file

3* Cross-platform Claude Code hook runner L4: * Works on Windows (cmd/powershell) and Linux/WSL (bash) L5: *

High

Shell

Package source references shell execution.

bin/hooks.mjsView on unpkg · L3

bin/run-migrations.mjsView file

61try { L62: const mod = await import(url); L63: if (mod && typeof mod.run === 'function' && typeof mod.name === 'string') {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/run-migrations.mjsView on unpkg · L61

bin/lib/file-sync.mjsView file

1/** L2: * Shared file-sync helper for the launcher (#854 §3) and the postinstall

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/lib/file-sync.mjsView on unpkg · L1

dist/src/cli/services/daemon-service.jsView file

8Trigger-reachable persistence chain: manifest.main -> dist/src/cli/index.js -> dist/src/cli/commands/index.js -> dist/src/cli/commands/daemon.js -> dist/src/cli/services/daemon-service.js L8: * - Linux: systemd --user unit in ~/.config/systemd/user/ L9: * - Windows: Task Scheduler ONLOGON trigger via schtasks L10: */ ... L14: import { homedir } from 'os'; L15: import { execSync } from 'child_process'; L16: import { locateMofloCliBin } from './moflo-require.js'; ... L35: const resolvedRoot = resolve(projectRoot); L36: const platform = options.platform ?? process.platform; L37: const run = options.runCommand ?? execSyncRunner; ... L100: const slug = projectRootSlug(projectRoot); L101: return join(options.homeDir ?? homedir(), 'Library', 'LaunchAgents', `${PLIST_LABEL}.${slug}.plist`); L102

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/src/cli/services/daemon-service.jsView on unpkg · L8

8* - Linux: systemd --user unit in ~/.config/systemd/user/ L9: * - Windows: Task Scheduler ONLOGON trigger via schtasks L10: */ ... L14: import { homedir } from 'os'; L15: import { execSync } from 'child_process'; L16: import { locateMofloCliBin } from './moflo-require.js'; ... L35: const resolvedRoot = resolve(projectRoot); L36: const platform = options.platform ?? process.platform; L37: const run = options.runCommand ?? execSyncRunner; ... L100: const slug = projectRootSlug(projectRoot); L101: return join(options.homeDir ?? homedir(), 'Library', 'LaunchAgents', `${PLIST_LABEL}.${slug}.plist`); L102: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/src/cli/services/daemon-service.jsView on unpkg · L8

bin/setup-project.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: const { generateclaudemd } = await import(moflointernalurl('dist/src/cli/init/claudemd-generator.js')); const { applyinjectionreplacement, computeinjectiondrift } = await import( moflointernalurl('dist/src/cli/services/claudemd-injection.js') ); const args = process.argv.slice(2); const updateonly = args.includes('--update'); const checkonly = args.includes('--check'); const claude_md_section = generateclaudemd({}).trimend(); function log(msg) { console.log(`[flo-setup] ${msg}`); } function findprojectroot() {

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/setup-project.mjsView on unpkg

dist/src/cli/init/moflo-init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const strippedattribution = removelegacyattribution(existing); const canonical = generatesettings({ ...default_init_options, targetdir: root, force: true }); const scaffoldkeys = ['statusline', 'permissions', 'env']; const scaffoldadded = []; for (const key of scaffoldkeys) { if (existing[key] == null && canonical[key] != null) {

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/cli/init/moflo-init.jsView on unpkg

dist/src/cli/update/executor.jsView file

62// Execute npm install L63: const installCmd = `npm install ${update.package}@${update.latestVersion} --save-exact`; L64: execSync(installCmd, { L65: encoding: 'utf-8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/update/executor.jsView on unpkg · L62

bin/index-tests.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 33

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/index-tests.mjs#virtual:normalized:round1View on unpkg

bin/index-tests.mjsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.12.11 matchedPath = bin/index-tests.mjs matchedIdentity = npm:bW9mbG8:4.12.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/index-tests.mjsView on unpkg

bin/lib/process-manager.mjsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.12.11 matchedPath = bin/lib/process-manager.mjs matchedIdentity = npm:bW9mbG8:4.12.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/process-manager.mjsView on unpkg

dist/src/cli/init/executor.jsView file

•matchType = token_shingles matchedPackage = moflo@4.12.11 matchedPath = dist/src/cli/init/executor.js matchedIdentity = npm:bW9mbG8:4.12.11 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/init/executor.jsView on unpkg

dist/src/cli/memory/bridge-core.jsView file

•matchType = normalized_sha256 matchedPackage = moflo@4.12.11 matchedPath = dist/src/cli/memory/bridge-core.js matchedIdentity = npm:bW9mbG8:4.12.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/memory/bridge-core.jsView on unpkg

dist/src/cli/commands/daemon.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = moflo@4.13.0 matchedIdentity = npm:bW9mbG8:4.13.0 similarity = 0.475 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/cli/commands/daemon.jsView on unpkg

Lines 2023-2063javascript

2023 },

2024 {

2025 id: 'refactor-consolidate-validators',

2026 description: 'Consolidate duplicate validation helpers',

2027 taskClass: 'refactor',

2028 prompt: 'Consolidate the duplicate assertion evaluation functions across analyzer and headless modules into a shared validation utility.',

2029 assertions: [

2030 { type: 'must-match-pattern', value: 'shared|common|util|helper', severity: 'major' },

2031 { type: 'must-contain', value: 'test', severity: 'major' },

2032 ],

2033 gatePatterns: [missingTestGate, destructiveGate, policyGate],

2034 },

2035 // ── Security (3 tasks) ────────────────────────────────────────────

2036 {

2037 id: 'security-cli-input-sanitize',

2038 description: 'Sanitize user input in CLI arguments',

2039 taskClass: 'security',

2040 prompt: 'Add input sanitization for all CLI arguments to prevent command injection. Never pass unsanitized user input to shell commands.',

2041 assertions: [

2042 { type: 'must-contain', value: 'sanitiz', severity: 'critical' },

2043 { type: 'must-match-pattern', value: 'escape|validate|regex|filter', severity: 'major' },

2044 { type: 'must-not-contain', value: 'eval(', severity: 'critical' },

2045 ],

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/cli/guidance/analyzer.jsView on unpkg · L2043

2046 gatePatterns: [destructiveGate, secretGate, policyGate],

2047 },

2048 {

2049 id: 'security-hmac-verification',

2050 description: 'Add HMAC verification to proof chain',

2051 taskClass: 'security',

2052 prompt: 'Implement HMAC-SHA256 verification for proof chain envelopes. Reject any envelope that fails signature verification.',

2053 assertions: [

2054 { type: 'must-match-pattern', value: 'hmac|sha256|verify|signature', severity: 'critical' },

2055 { type: 'must-contain', value: 'reject', severity: 'major' },

2056 ],

2057 gatePatterns: [secretGate, policyGate],

2058 },

2059 {

2060 id: 'security-secret-scanning',

2061 description: 'Implement secret scanning for committed files',

2062 taskClass: 'security',

2063 prompt: 'Build a secret scanner that detects hardcoded passwords, API keys, and credentials in staged files before commit.',