registry / Credential exfiltration / triflux / 10.50.2

triflux@10.50.2

CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude

AI Security Review

scanned 15d ago · by lpm-firewall-ai

Source inspection confirms that an interactive registration request can send the local hub token to an unrestricted TFX_HUB_URL. The default loopback destination and need for an alternate URL make this a warning for conditional credential exposure, not a confirmed attack.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

An interactive session starts and invokes default session registration while TFX_HUB_URL points to an untrusted destination.

Impact

A configured remote recipient could receive the hub token and use it to access the hub, depending on the token's permissions.

Mechanism

The helper uses TFX_HUB_URL as its request base and attaches the hub token to the POST authorization header; it does not enforce a destination allowlist.

AI rationale

Evidence

hub/team/synapse-http.mjsscripts/lib/session-presence.mjs

Network endpoints2

TFX_HUB_URL127.0.0.1

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

hub/team/synapse-http.mjs reads the hub token from TFX_HUB_TOKEN or the token file.
hub/team/synapse-http.mjs accepts TFX_HUB_URL as the request base without restricting its destination.
The request helper attaches the hub token as a Bearer credential and sends a POST.
scripts/lib/session-presence.mjs calls the default session registration function when an interactive session starts.

Evidence against

Without TFX_HUB_URL, the helper falls back to a loopback hub address.
The token is omitted when a caller explicitly sets token to false.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 288 file(s), 3.18 MB of source, external domains: 127.0.0.1, api.openai.com, developers.openai.com, github.com, notion.so, platform.claude.com, registry.npmjs.org

Source & flagged code

16 flagged

package.jsonView file

Lines 1-40json

2 "name": "triflux",

3 "version": "10.50.2",

4 "description": "CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude",

5 "type": "module",

6 "bin": {

7 "triflux": "bin/triflux.mjs",

8 "tfx": "bin/triflux.mjs",

9 "tfl": "bin/triflux.mjs",

10 "tfx-live": "bin/tfx-live.mjs",

11 "tfx-setup": "bin/tfx-setup.mjs",

12 "tfx-doctor": "bin/tfx-doctor.mjs",

13 "tfx-doctor-tui": "bin/tfx-doctor-tui.mjs",

14 "tfx-setup-tui": "bin/tfx-setup-tui.mjs"

15 },

16 "engines": {

17 "node": ">=20"

18 },

19 "scripts": {

20 "postinstall": "node scripts/setup.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

21 },

22 "dependencies": {

23 "@iarna/toml": "^2.2.5",

24 "@triflux/core": "^10.25.0",

25 "@triflux/remote": "^10.25.0"

26 },

27 "optionalDependencies": {

28 "cloakbrowser": "0.5.12",

29 "playwright-core": "^1.53.0"

30 },

31 "files": [

32 "adapters",

33 "bin",

34 "tui",

35 "config",

36 "cto",

37 "skills",

38 "!skills/tfx-workspace",

39 "hooks",

40 "hud",

bin/tfx-live.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFile } from "node:child_process";

3import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

4import { mkdirSync, realpathSync, statSync, writeFileSync } from "node:fs";

bin/triflux.mjsView file

Lines 2009-2049javascript

2009 const cleanup = cleanupLegacyHooks({

2010 settingsPath: join(CLAUDE_DIR, "settings.json"),

2011 });

2012 if (!cleanup.ok) {

2013

bin/tfx-setup-tui.mjsView file

Lines 1-8javascript

1#!/usr/bin/env node

2import { dirname, join } from "node:path";

3// tfx-setup-tui — Interactive Setup Wizard TUI entry point

4import { fileURLToPath } from "node:url";

6const root = dirname

hub/workers/lib/jsonrpc-ws-uds.mjsView file

Lines 1-21javascript

1// hub/workers/lib/jsonrpc-ws-uds.mjs

2// JSON-RPC 2.0 client over WebSocket-over-Unix-Domain-Socket.

3//

Low

Weak Crypto

Package source references weak cryptographic algorithms.

hub/workers/lib/jsonrpc-ws-uds.mjsView on unpkg · L1

4// codex `app-server --listen unix://PATH` does NOT speak newline-delimited JSON

5// on the socket — it speaks WebSocket (RFC 6455) after a standard HTTP/1.1

6// Upgrade handshake, one JSON-RPC message per text frame. Confirmed live against

7// codex-cli 0.135.0 (see experiments/native-bridge-feasibility/

8// codex-app-server-uds-probe.mjs). This is the UDS sibling of the stdio

scripts/setup.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

3// triflux 설치 및 업데이트 설정 스크립트

4// - tfx-route.sh를 ~/.claude/scripts/에 동기화

5// - hud-qos-status.mjs를 ~/.claude/hud/에 동기화

6// - skills/를 ~/.claude/skills/에 동기화

8import { createHash } from "node:crypto";

9import { execFileSync, spawn } from

hub/team/synapse-http.mjsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { createHash } from "node:crypto";

3import { existsSync, readFileSync } from "node:fs";

4import { homedir, hostname } from "node:os";

scripts/mcp-check.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: for (const mcpjson of scanpluginsmcpjson()) { for (const { name, config } of extractmcpservernames(mcpjson)) { if (!servermap.has(name)) { servermap.set(name, createserverrecord(name, "configured", config)); } } } for (const settingsfile of ["settings.json", "settings.local.json"]) { const data = readjsonsafe(join(claude_dir, settingsfile)); if (!data?.mcpservers) continue; for (const [name, config] of object.entries(data.mcpservers)) { if (typeof name !== "string" || !name.trim()) continue; if (!servermap.has(name.trim())) { servermap.set( name.trim(),

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/mcp-check.mjsView on unpkg

scripts/ensure-codex-hooks.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. *\\{\\s*trusted_hash\\s*=\\s*"([^"]+)"`, "gm", ); const tablere = new regexp( `^\\[hooks\\.state\\.(${escapedkeys.join("|")})\\]\\s*\\n[ \\t]*trusted_hash\\s*=\\s*"([^"]+)"`, "gm", ); for (const re of [inlinere, tablere]) { let m = re.exec(content); while (m) { found.push({ key: m[1].replace(/^"|"$/g, ""), hash: m[2] }); m = re.exec(content); } } return found; } function hooksstateconverged(content, entries, hookspath) { const managedkeys = new set(entries.map((entry) => entry.key)); const found = collectmanagedstate(content, managedkeys, hookspath); return entries.every((entry) => { const matches = found.filter((f) => f

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/ensure-codex-hooks.mjsView on unpkg

scripts/completions/tfx.zshView file

•path = scripts/completions/tfx.zsh kind = build_helper sizeBytes = 4256 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/completions/tfx.zshView on unpkg

hub/lib/process-utils.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hub/lib/process-utils.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/tfx-live.mjsView file

1#!/usr/bin/env node L2: import { execFile } from "node:child_process"; L3: import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

bin/triflux.mjsView file

2029L2030: // ── psmux 기본 셸 자동 수정 (cmd.exe → PowerShell) ── L2031: if (process.platform === "win32" && which("psmux")) {

High

Shell

Package source references shell execution.

Findings

1 Critical11 High6 Medium5 Low

CriticalAi Agent Control Hijackscripts/setup.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/tfx-live.mjs

HighShellbin/triflux.mjs

HighSame File Env Network Executionbin/triflux.mjs

HighCredential Exfiltrationhub/team/synapse-http.mjs

HighExternal Ai Agent Control Surface Mutationscripts/mcp-check.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/ensure-codex-hooks.mjs

HighTrigger Reachable Credential Exfiltrationhub/team/synapse-http.mjs

HighTrigger Reachable Persistencescripts/setup.mjs

HighRuntime Package Installbin/triflux.mjs

Affected versions and remediation

This report applies to triflux@10.50.2.

See all versions of triflux for other recorded verdicts.

Review the evidence and your use of triflux@10.50.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-07 23:25:21.064Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code