registry / Credential exfiltration / triflux / 10.47.0

triflux@10.47.0

CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The code forwards an existing hub token to an unrestricted TFX_HUB_URL when headless session registration runs. Because this is conditional on endpoint configuration and the default is loopback, the evidence supports a warning for credential exposure rather than a block.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A headless worker registers a Synapse session while TFX_HUB_URL is set to a non-loopback destination.

Impact

A configured remote recipient could receive the hub token and use it to authenticate to the hub.

Mechanism

The helper reads the hub token and places it in the Authorization header of a POST to the configured URL, without a destination allowlist.

AI rationale

Evidence

hub/team/synapse-http.mjshub/team/headless.mjs

Network endpoints1

127.0.0.1:27888

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

hub/team/synapse-http.mjs reads the hub token from TFX_HUB_TOKEN or the user’s .claude token file.
hub/team/synapse-http.mjs accepts TFX_HUB_URL without restricting its destination; absent that setting, it uses loopback.
hub/team/synapse-http.mjs attaches the hub token as a Bearer authorization header and sends the request with fetch.
hub/team/headless.mjs registers workers through the Synapse session helper, making this path reachable during headless orchestration.

Evidence against

The default Synapse destination is the local hub at 127.0.0.1:27888.
The token is described and used as hub authentication; the inspected code does not establish that a remote destination is enabled by default.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

15 flagged

bin/tfx-live.mjsView file

1#!/usr/bin/env node L2: import { execFile } from "node:child_process"; L3: import { mkdirSync, realpathSync, statSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

bin/triflux.mjsView file

2222L2223: // ── psmux 기본 셸 자동 수정 (cmd.exe → PowerShell) ── L2224: if (process.platform === "win32" && which("psmux")) {

High

Shell

Package source references shell execution.

bin/triflux.mjsView on unpkg · L2222

2357if (existsSync(join(PKG_ROOT, "hub", "server.mjs"))) { L2358: const defaultHubUrl = `http://127.0.0.1:${process.env.TFX_HUB_PORT || "27888"}/mcp`; L2359: autoRegisterMcp(defaultHubUrl, { codexEnabled: false }); ... L2368: const script = join(PKG_ROOT, "scripts", "setup.mjs"); L2369: execFileSync( L2370: process.execPath,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/triflux.mjsView on unpkg · L2357

3783if (fix) { L3784: // --fix 모드: npm install 실행 (Windows 호환 shell: true) L3785: info(`npm install 실행 중 (${PKG_ROOT})...`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/triflux.mjsView on unpkg · L3783

bin/tfx-setup-tui.mjsView file

6const root = dirname(dirname(fileURLToPath(import.meta.url))); L7: await import(join(root, "tui", "setup.mjs"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tfx-setup-tui.mjsView on unpkg · L6

hooks/hook-orchestrator.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

3// hooks/hook-orchestrator.mjs — 범용 훅 체이닝 엔진

4//

5// settings.json에 이벤트당 하나만 등록. stdin JSON에서 이벤트명+툴명을 읽고

6// hook-registry.json의 우선순위대로 훅을 순차 실행한다.

7//

8// 실행 규칙:

9// - priority 낮을수록 먼저 실행 (triflux=0, omc=50, external=100)

10// - blocking:true 훅이 exit 2 반환 → 즉시 중단, 이후 훅 건너뜀

11// - 출력(stdout JSON)은 마지막 유효 출력으로 머지

scripts/setup.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

3// triflux 세션 시작 시 자동 설정 스크립트

4// - tfx-route.sh를 ~/.claude/scripts/에 동기화

5// - hud-qos-status.mjs를 ~/.claude/hud/에 동기화

6// - skills/를 ~/.claude/skills/에 동기화

8import { execFileSync, spawn } from "child_process";

9import {

Medium

hub/team/synapse-http.mjsView file

1import { execFileSync } from "node:child_process"; L2: import { createHash } from "node:crypto"; ... L11: // packages/core mirror (which cannot carry relative cross-package imports). L12: const HUB_TOKEN_FILE = join(homedir(), ".claude", ".tfx-hub-token"); L13: ... L29: .update(String(value || "")) L30: .digest("base64url") L31: .slice(0, 22)}`; ... L42: function resolveProjectId(cwd, meta, opts = {}) { L43: const explicit = meta?.project_id || process.env.TFX_PROJECT_ID; L44: if (explicit) return normalizedProjectId(explicit); ... L106: process.env.TFX_HOST_ID ||

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

hub/team/synapse-http.mjsView on unpkg · L1

1Trigger-reachable credential exfiltration chain: manifest.bin -> bin/triflux.mjs -> hub/team/swarm-cli.mjs -> hub/team/swarm-hypervisor.mjs -> hub/team/conductor.mjs -> hub/team/synapse-http.mjs L1: import { execFileSync } from "node:child_process"; L2: import { createHash } from "node:crypto"; ... L11: // packages/core mirror (which cannot carry relative cross-package imports). L12: const HUB_TOKEN_FILE = join(homedir(), ".claude", ".tfx-hub-token"); L13: ... L29: .update(String(value || "")) L30: .digest("base64url") L31: .slice(0, 22)}`; ... L42: function resolveProjectId(cwd, meta, opts = {}) { L43: const explicit = meta?.project_id || process.env.TFX_PROJECT_ID; L44: if (explicit) return normalizedProjectId(explicit); ... L106: process.env.TFX_HOST_ID ||

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

hub/team/synapse-http.mjsView on unpkg · L1

scripts/mcp-check.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: for (const mcpjson of scanpluginsmcpjson()) { for (const { name, config } of extractmcpservernames(mcpjson)) { if (!servermap.has(name)) { servermap.set(name, createserverrecord(name, "configured", config)); } } } for (const settingsfile of ["settings.json", "settings.local.json"]) { const data = readjsonsafe(join(claude_dir, settingsfile)); if (!data?.mcpservers) continue; for (const [name, config] of object.entries(data.mcpservers)) { if (typeof name !== "string" || !name.trim()) continue; if (!servermap.has(name.trim())) { servermap.set( name.trim(),

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/mcp-check.mjsView on unpkg

scripts/ensure-codex-hooks.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. *\\{\\s*trusted_hash\\s*=\\s*"([^"]+)"`, "gm", ); const tablere = new regexp( `^\\[hooks\\.state\\.(${escapedkeys.join("|")})\\]\\s*\\n[ \\t]*trusted_hash\\s*=\\s*"([^"]+)"`, "gm", ); for (const re of [inlinere, tablere]) { let m = re.exec(content); while (m) { found.push({ key: m[1].replace(/^"|"$/g, ""), hash: m[2] }); m = re.exec(content); } } return found; } function hooksstateconverged(content, entries, hookspath) { const managedkeys = new set(entries.map((entry) => entry.key)); const found = collectmanagedstate(content, managedkeys, hookspath); return entries.every((entry) => { const matches = found.filter((f) => f

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/ensure-codex-hooks.mjsView on unpkg

scripts/completions/tfx.zshView file

•path = scripts/completions/tfx.zsh kind = build_helper sizeBytes = 4853 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/completions/tfx.zshView on unpkg

hub/lib/process-utils.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hub/lib/process-utils.mjs#virtual:normalized:round1View on unpkg

hub/team/headless.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = triflux@10.41.1 matchedIdentity = npm:dHJpZmx1eA:10.41.1 similarity = 0.458 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

hub/team/headless.mjsView on unpkg

Source & flagged code

15 flagged · loading source

bin/tfx-live.mjsView file

1#!/usr/bin/env node L2: import { execFile } from "node:child_process"; L3: import { mkdirSync, realpathSync, statSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

bin/triflux.mjsView file

2222L2223: // ── psmux 기본 셸 자동 수정 (cmd.exe → PowerShell) ── L2224: if (process.platform === "win32" && which("psmux")) {

High

Shell

Package source references shell execution.

bin/triflux.mjsView on unpkg · L2222

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

Findings

1 Critical10 High6 Medium4 Low

CriticalPrevious Version Dangerous Deltahub/team/headless.mjs

HighChild Processbin/tfx-live.mjs

HighShellbin/triflux.mjs

HighSame File Env Network Executionbin/triflux.mjs

HighCredential Exfiltrationhub/team/synapse-http.mjs

HighExternal Ai Agent Control Surface Mutationscripts/mcp-check.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/ensure-codex-hooks.mjs

HighTrigger Reachable Credential Exfiltrationhub/team/synapse-http.mjs

HighTrigger Reachable Persistencescripts/setup.mjs

HighRuntime Package Installbin/triflux.mjs

HighSemantic Analysis Limitedhub/lib/process-utils.mjs#virtual:normalized:round1

Affected versions and remediation

This report applies to triflux@10.47.0.

See all versions of triflux for other recorded verdicts.

Review the evidence and your use of triflux@10.47.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 19:09:38.652Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code