registry / triflux / 10.54.0

triflux@10.54.0

CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The postinstall hook automatically installs a first-party Codex extension, creating a real lifecycle configuration risk. Its behavior is limited in the inspected path and Codex approval remains required, so this warrants a warning rather than a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through npm, which runs its postinstall script.

Impact

The package gains a persistent local hook capability after installation. Codex approval remains required before the hook is trusted; no remote transfer was identified in the inspected path.

Mechanism

Setup writes hooks to the user's Codex configuration; the hooks invoke the package's session hook, which records session identifiers and local session details.

AI rationale

Evidence

package.jsonscripts/setup.mjsscripts/ensure-codex-hooks.mjshooks/codex-session-hook.mjshub/lib/codex-session-registry.mjs

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest runs scripts/setup.mjs during postinstall, and the installed package takes the deferred setup path.
Deferred setup runs the hook setup without an interactive prompt; it registers package-owned Codex session hooks without pre-approving them.
The hooks record session identifiers and local session metadata; Codex trust hashes are written only when approval is requested.
The supplied integration targets resolve to local configuration, session-index, and bug-report handling; I found no authenticated account action or credential transfer in those inspected locations.

Evidence against

The hook remains untrusted until Codex approval, so Codex can prompt before running it.
The inspected hook records local metadata and contains no network send.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

Source & flagged code

25 flagged

package.jsonView file

Lines 1-37json

2 "name": "triflux",

3 "version": "10.54.0",

4 "description": "CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude",

5 "type": "module",

6 "bin": {

7 "triflux": "bin/triflux.mjs",

8 "tfx": "bin/triflux.mjs",

9 "tfx-live": "bin/tfx-live.mjs",

10 "tfx-setup": "bin/tfx-setup.mjs",

11 "tfx-doctor": "bin/tfx-doctor.mjs"

12 },

13 "engines": {

14 "node": ">=22"

15 },

16 "scripts": {

17 "postinstall": "node scripts/setup.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

18 },

19 "dependencies": {

20 "@iarna/toml": "^2.2.5"

21 },

22 "files": [

23 "adapters",

24 "bin",

25 "config",

26 "skills",

27 "!skills/tfx-workspace",

28 "hooks",

29 "hud",

30 "scripts",

31 "!scripts/__tests__",

32 "hub",

33 "docs/assets/logo-dark.svg",

34 "docs/assets/logo-light.svg",

35 "docs/assets/social-preview.png",

36 "docs/assets/social-preview.svg",

37 "README.md",

bin/tfx-live.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFile } from "node:child_process";

3import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

4import { mkdirSync, realpathSync, statSync, writeFileSync } from "node:fs";

bin/triflux.mjsView file

Lines 1351-1391javascript

1351 summary.push({ item: "HUD statusLine", status: "✅", detail });

1352 } catch (e) {

1353 throw createCliError(`settings.json 처리 실패: ${e.message}`, {

1354 exitCode: EXIT_CONFIG_ERROR

scripts/lib/install-retire.mjsView file

49try { L50: return new Set(JSON.parse(readFileSync(HISTORY_FILE, "utf8"))); L51: } catch {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/lib/install-retire.mjsView on unpkg · L49

scripts/setup.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

3// triflux 설치 및 업데이트 설정 스크립트

4// - tfx-route.sh를 ~/.claude/scripts/에 동기화

5// - hud-qos-status.mjs를 ~/.claude/hud/에 동기화

6// - skills/를 ~/.claude/skills/에 동기화

8import { createHash } from "node:crypto";

9import { execFileSync, spawn } from

scripts/mcp-check.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: , config)); } } } for (const mcpjson of scanpluginsmcpjson()) { for (const { name, config } of extractmcpservernames(mcpjson)) { if (!servermap.has(name)) { servermap.set(name, createserverrecord(name, "configured", config)); } } } for (const settingsfile of ["settings.json", "settings.local.json"]) { const data = readjsonsafe(join(claude_dir, settingsfile)); if (!data?.mcpservers) continue; for (const [name, config] of object.entries(data.mcpservers)) { if (typeof name !== "string" || !name.trim()) continue; if (!servermap.has(n

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/mcp-check.mjsView on unpkg

scripts/ensure-codex-hooks.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nction mergehooksstate(content, entries, hookspath) { const managedkeys = new set(entries.map((entry) => entry.key)); if (hooksstateconverged(content, entries, hookspath)) { return content; } return appendstateblocks( stripmanagedstatelines(content, managedkeys, hookspath), entries, ); }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/ensure-codex-hooks.mjsView on unpkg

scripts/lib/codex-recovery.shView file

•path = scripts/lib/codex-recovery.sh kind = build_helper sizeBytes = 3399 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/lib/codex-recovery.shView on unpkg

hub/team/headless.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hub/team/headless.mjs#virtual:normalized:round1View on unpkg

hub/team/headless.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.55.1 matchedPath = hub/team/headless.mjs matchedIdentity = npm:dHJpZmx1eA:10.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hub/team/headless.mjsView on unpkg

hud/providers/claude.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.55.1 matchedPath = hud/providers/claude.mjs matchedIdentity = npm:dHJpZmx1eA:10.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hud/providers/claude.mjsView on unpkg

scripts/lib/mcp-health.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.76.0 matchedPath = scripts/lib/mcp-health.mjs matchedIdentity = npm:dHJpZmx1eA:10.76.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/lib/mcp-health.mjsView on unpkg

hub/team/claude-daemon-control.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.76.0 matchedPath = hub/team/claude-daemon-control.mjs matchedIdentity = npm:dHJpZmx1eA:10.76.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hub/team/claude-daemon-control.mjsView on unpkg

hub/team/intervention.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.76.0 matchedPath = hub/team/intervention.mjs matchedIdentity = npm:dHJpZmx1eA:10.76.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hub/team/intervention.mjsView on unpkg

scripts/check-codex-config-stable.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.76.0 matchedPath = scripts/check-codex-config-stable.mjs matchedIdentity = npm:dHJpZmx1eA:10.76.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/check-codex-config-stable.mjsView on unpkg

scripts/lib/tmr-install.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.55.1 matchedPath = scripts/lib/tmr-install.mjs matchedIdentity = npm:dHJpZmx1eA:10.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/lib/tmr-install.mjsView on unpkg

scripts/release/resolve-auto-release.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.76.0 matchedPath = scripts/release/resolve-auto-release.mjs matchedIdentity = npm:dHJpZmx1eA:10.76.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release/resolve-auto-release.mjsView on unpkg

hub/lib/codex-session-registry.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.76.0 matchedPath = hub/lib/codex-session-registry.mjs matchedIdentity = npm:dHJpZmx1eA:10.76.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hub/lib/codex-session-registry.mjsView on unpkg

hub/lib/spawn-trace.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.76.0 matchedPath = hub/lib/spawn-trace.mjs matchedIdentity = npm:dHJpZmx1eA:10.76.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hub/lib/spawn-trace.mjsView on unpkg

hub/team/agents-row.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.76.0 matchedPath = hub/team/agents-row.mjs matchedIdentity = npm:dHJpZmx1eA:10.76.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hub/team/agents-row.mjsView on unpkg

Source & flagged code

25 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/tfx-live.mjsView file

1#!/usr/bin/env node L2: import { execFile } from "node:child_process"; L3: import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = triflux@10.55.1 matchedPath = bin/tfx-live.mjs matchedIdentity = npm:dHJpZmx1eA:10.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/tfx-live.mjsView on unpkg

Findings

1 Critical20 High6 Medium5 Low

CriticalAi Agent Control Hijackscripts/setup.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/tfx-live.mjs

HighShellbin/triflux.mjs

HighExternal Ai Agent Control Surface Mutationscripts/mcp-check.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/ensure-codex-hooks.mjs

HighTrigger Reachable Persistencescripts/setup.mjs

HighRuntime Package Installbin/triflux.mjs

HighSemantic Analysis Limitedhub/team/headless.mjs#virtual:normalized:round1

HighKnown Malware Source Similarityhub/team/headless.mjs

HighKnown Malware Source Similarityhud/providers/claude.mjs

Affected versions and remediation

This report applies to triflux@10.54.0.

See all versions of triflux for other recorded verdicts.

Review the evidence and your use of triflux@10.54.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-16 03:12:12.034Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code