registry / triflux / 10.51.0

triflux@10.51.0

CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude

AI Security Review

scanned 15d ago · by lpm-firewall-ai

Postinstall setup can configure Codex session hooks without a separate setup command. The inspected hook behavior is session registration with a local hub, supporting a warning for agent extension lifecycle risk rather than a confirmed attack.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Installing the package when the user's Codex home exists.

Impact

Codex runs Triflux session registration and heartbeat logic during relevant events.

Mechanism

The setup script invokes Codex hook registration, which updates Codex hooks and configuration to call the package's session hook.

AI rationale

Evidence

package.jsonscripts/setup.mjsscripts/ensure-codex-hooks.mjshooks/codex-session-hook.mjshub/team/synapse-http.mjs~/.codex/hooks.json~/.codex/config.toml

Network endpoints1

127.0.0.1:27888

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs `scripts/setup.mjs` automatically from its postinstall hook.
Setup calls Codex hook registration, which targets the user's Codex hooks and config files.
The registered hook records session information on session start and prompt submission.
Synapse requests default to a loopback hub URL; no credential exfiltration was established in the inspected path.

Evidence against

The Codex hook helper skips when the user's Codex directory does not exist.
The hook performs session registration and heartbeat work rather than showing credential collection in the inspected code.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 232 file(s), 2.59 MB of source, external domains: 127.0.0.1, api.openai.com, developers.openai.com, github.com, notion.so, platform.claude.com, registry.npmjs.org

Source & flagged code

16 flagged

package.jsonView file

Lines 1-40json

2 "name": "triflux",

3 "version": "10.51.0",

4 "description": "CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude",

5 "type": "module",

6 "bin": {

7 "triflux": "bin/triflux.mjs",

8 "tfx": "bin/triflux.mjs",

9 "tfl": "bin/triflux.mjs",

10 "tfx-live": "bin/tfx-live.mjs",

11 "tfx-setup": "bin/tfx-setup.mjs",

12 "tfx-doctor": "bin/tfx-doctor.mjs",

13 "tfx-doctor-tui": "bin/tfx-doctor-tui.mjs",

14 "tfx-setup-tui": "bin/tfx-setup-tui.mjs"

15 },

16 "engines": {

17 "node": ">=20"

18 },

19 "scripts": {

20 "postinstall": "node scripts/setup.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

21 },

22 "dependencies": {

23 "@iarna/toml": "^2.2.5",

24 "@triflux/core": "^10.25.0",

25 "@triflux/remote": "^10.25.0"

26 },

27 "optionalDependencies": {

28 "cloakbrowser": "0.5.12",

29 "playwright-core": "^1.53.0"

30 },

31 "files": [

32 "adapters",

33 "bin",

34 "tui",

35 "config",

36 "cto",

37 "skills",

38 "!skills/tfx-workspace",

39 "hooks",

40 "hud",

bin/tfx-live.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFile } from "node:child_process";

3import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

4import { mkdirSync, realpathSync, statSync, writeFileSync } from "node:fs";

bin/triflux.mjsView file

Lines 1903-1943javascript

1903 settingsPath: join(CLAUDE_DIR, "settings.json"),

1904 });

1905 if (!cleanup.ok) {

1906 throw createCliError(`이전 hook 정리 실패: ${cleanup.error

bin/tfx-setup-tui.mjsView file

Lines 1-8javascript

1#!/usr/bin/env node

2import { dirname, join } from "node:path";

3// tfx-setup-tui — Interactive Setup Wizard TUI entry point

4import { fileURLToPath } from "node:url";

6const root = dirname

hub/workers/lib/jsonrpc-ws-uds.mjsView file

Lines 1-21javascript

1// hub/workers/lib/jsonrpc-ws-uds.mjs

2// JSON-RPC 2.0 client over WebSocket-over-Unix-Domain-Socket.

3//

Low

Weak Crypto

Package source references weak cryptographic algorithms.

hub/workers/lib/jsonrpc-ws-uds.mjsView on unpkg · L1

4// codex `app-server --listen unix://PATH` does NOT speak newline-delimited JSON

5// on the socket — it speaks WebSocket (RFC 6455) after a standard HTTP/1.1

6// Upgrade handshake, one JSON-RPC message per text frame. Confirmed live against

7// codex-cli 0.135.0 (see experiments/native-bridge-feasibility/

8// codex-app-server-uds-probe.mjs). This is the UDS sibling of the stdio

scripts/setup.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

3// triflux 설치 및 업데이트 설정 스크립트

4// - tfx-route.sh를 ~/.claude/scripts/에 동기화

5// - hud-qos-status.mjs를 ~/.claude/hud/에 동기화

6// - skills/를 ~/.claude/skills/에 동기화

8import { createHash } from "node:crypto";

9import { execFileSync, spawn } from

hub/team/synapse-http.mjsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { createHash } from "node:crypto";

3import { existsSync, readFileSync } from "node:fs";

4import { homedir, hostname } from "node:os";

scripts/mcp-check.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: for (const mcpjson of scanpluginsmcpjson()) { for (const { name, config } of extractmcpservernames(mcpjson)) { if (!servermap.has(name)) { servermap.set(name, createserverrecord(name, "configured", config)); } } } for (const settingsfile of ["settings.json", "settings.local.json"]) { const data = readjsonsafe(join(claude_dir, settingsfile)); if (!data?.mcpservers) continue; for (const [name, config] of object.entries(data.mcpservers)) { if (typeof name !== "string" || !name.trim()) continue; if (!servermap.has(name.trim())) { servermap.set( name.trim(),

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/mcp-check.mjsView on unpkg

scripts/ensure-codex-hooks.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. *\\{\\s*trusted_hash\\s*=\\s*"([^"]+)"`, "gm", ); const tablere = new regexp( `^\\[hooks\\.state\\.(${escapedkeys.join("|")})\\]\\s*\\n[ \\t]*trusted_hash\\s*=\\s*"([^"]+)"`, "gm", ); for (const re of [inlinere, tablere]) { let m = re.exec(content); while (m) { found.push({ key: m[1].replace(/^"|"$/g, ""), hash: m[2] }); m = re.exec(content); } } return found; } function hooksstateconverged(content, entries, hookspath) { const managedkeys = new set(entries.map((entry) => entry.key)); const found = collectmanagedstate(content, managedkeys, hookspath); return entries.every((entry) => { const matches = found.filter((f) => f

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/ensure-codex-hooks.mjsView on unpkg

scripts/completions/tfx.zshView file

•path = scripts/completions/tfx.zsh kind = build_helper sizeBytes = 3577 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/completions/tfx.zshView on unpkg

hub/lib/process-utils.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hub/lib/process-utils.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/tfx-live.mjsView file

1#!/usr/bin/env node L2: import { execFile } from "node:child_process"; L3: import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

bin/triflux.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = triflux@10.50.2 matchedIdentity = npm:dHJpZmx1eA:10.50.2 similarity = 0.633 summary = stored previous version shares package body but lacks this dangerous source file

Findings

2 Critical10 High6 Medium5 Low

CriticalAi Agent Control Hijackscripts/setup.mjs

CriticalPrevious Version Dangerous Deltabin/triflux.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/tfx-live.mjs

HighShellbin/triflux.mjs

HighSame File Env Network Executionbin/triflux.mjs

HighCredential Exfiltrationhub/team/synapse-http.mjs

HighExternal Ai Agent Control Surface Mutationscripts/mcp-check.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/ensure-codex-hooks.mjs

HighTrigger Reachable Persistencescripts/setup.mjs

HighRuntime Package Installbin/triflux.mjs

Affected versions and remediation

This report applies to triflux@10.51.0.

See all versions of triflux for other recorded verdicts.

Review the evidence and your use of triflux@10.51.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 00:07:39.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code