registry / triflux / 10.57.3

triflux@10.57.3

CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The automatic setup performs package-owned agent integration before optional consent steps, a guarded lifecycle capability that warrants a warning under the review policy. Inspected source does not show an independently supported attack chain or establish unconsented mutation of a foreign agent control surface.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through npm invokes its postinstall hook.

Impact

This enables first-party agent integration during installation; inspected source does not establish a concrete malicious attack.

Mechanism

The hook runs deferred setup, which copies files from the package into configured destinations before later optional consent steps.

AI rationale

Evidence

package.jsonscripts/setup.mjs

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest runs scripts/setup.mjs automatically through postinstall.
The hook invokes deferred setup for installed packages, which syncs package files into user configuration locations.
The sync loop copies package files into destination directories without a consent check in that loop; separate consent steps occur later.
Interactive consent steps cover optional installs such as psmux, Codex hooks, and mods; they do not gate the earlier file synchronization.

Evidence against

The setup is package-owned and its destinations align with the CLI’s stated agent integration.
The inspected source shows no evidence of credential exfiltration, remote payload execution, or broad foreign agent control-surface mutation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

25 flagged

package.jsonView file

Lines 1-37json

2 "name": "triflux",

3 "version": "10.57.3",

4 "description": "CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude",

5 "type": "module",

6 "bin": {

7 "triflux": "bin/triflux.mjs",

8 "tfx": "bin/triflux.mjs",

9 "tfx-live": "bin/tfx-live.mjs",

10 "tfx-setup": "bin/tfx-setup.mjs",

11 "tfx-doctor": "bin/tfx-doctor.mjs"

12 },

13 "engines": {

14 "node": ">=22"

15 },

16 "scripts": {

17 "postinstall": "node scripts/setup.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

18 },

19 "dependencies": {

20 "@iarna/toml": "^2.2.5"

21 },

22 "files": [

23 "adapters",

24 "bin",

25 "config",

26 ".claude/rules/tfx-routing.md",

27 "skills",

28 "!skills/tfx-workspace",

29 "hooks",

30 "hud",

31 "scripts",

32 "!scripts/__tests__",

33 "hub",

34 "docs/assets/logo-dark.svg",

35 "docs/assets/logo-light.svg",

36 "docs/assets/social-preview.png",

37 "docs/assets/social-preview.svg",

bin/tfx-live.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFile } from "node:child_process";

3import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

4import { mkdirSync, realpathSync, statSync, writeFileSync } from "node:fs";

bin/triflux.mjsView file

Lines 1356-1396javascript

1356 summary.push({ item: "HUD statusLine", status: "✅", detail });

1357 } catch (e) {

1358 throw createCliError(`settings.json 처리 실패: ${e.message}`, {

1359 exitCode: EXIT_CONFIG_ERROR

scripts/lib/install-retire.mjsView file

Lines 29-69javascript

29 /^synapse-sessions\.json$/,

30 /^team-native-.+\.json$/,

31];

32// 토큰 사본은 보관하지 않고 바로 지운다.

33const

scripts/setup.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

3// triflux 설치 및 업데이트 설정 스크립트

4// - tfx-route.sh를 ~/.claude/scripts/에 동기화

5// - hud-qos-status.mjs를 ~/.claude/hud/에 동기화

6// - skills/를 ~/.claude/skills/에 동기화

8import { createHash } from "node:crypto";

9import { execFileSync, spawn } from

scripts/mcp-check.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: , config)); } } } for (const mcpjson of scanpluginsmcpjson()) { for (const { name, config } of extractmcpservernames(mcpjson)) { if (!servermap.has(name)) { servermap.set(name, createserverrecord(name, "configured", config)); } } } for (const settingsfile of ["settings.json", "settings.local.json"]) { const data = readjsonsafe(join(claude_dir, settingsfile)); if (!data?.mcpservers) continue; for (const [name, config] of object.entries(data.mcpservers)) { if (typeof name !== "string" || !name.trim()) continue; if (!servermap.has(n

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/mcp-check.mjsView on unpkg

scripts/ensure-codex-hooks.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nction mergehooksstate(content, entries, hookspath) { const managedkeys = new set(entries.map((entry) => entry.key)); if (hooksstateconverged(content, entries, hookspath)) { return content; } return appendstateblocks( stripmanagedstatelines(content, managedkeys, hookspath), entries, ); }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/ensure-codex-hooks.mjsView on unpkg

scripts/lib/codex-recovery.shView file

•path = scripts/lib/codex-recovery.sh kind = build_helper sizeBytes = 3399 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/lib/codex-recovery.shView on unpkg

hub/team/headless.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hub/team/headless.mjs#virtual:normalized:round1View on unpkg

hub/team/headless.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.55.1 matchedPath = hub/team/headless.mjs matchedIdentity = npm:dHJpZmx1eA:10.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hub/team/headless.mjsView on unpkg

scripts/lib/legacy-mcp-cleanup.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.55.1 matchedPath = scripts/lib/legacy-mcp-cleanup.mjs matchedIdentity = npm:dHJpZmx1eA:10.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/lib/legacy-mcp-cleanup.mjsView on unpkg

scripts/lib/mcp-health.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.55.1 matchedPath = scripts/lib/mcp-health.mjs matchedIdentity = npm:dHJpZmx1eA:10.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/lib/mcp-health.mjsView on unpkg

hub/team/claude-daemon-control.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.55.1 matchedPath = hub/team/claude-daemon-control.mjs matchedIdentity = npm:dHJpZmx1eA:10.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hub/team/claude-daemon-control.mjsView on unpkg

hub/team/codex-queue.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.55.1 matchedPath = hub/team/codex-queue.mjs matchedIdentity = npm:dHJpZmx1eA:10.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hub/team/codex-queue.mjsView on unpkg

hub/team/intervention.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.55.1 matchedPath = hub/team/intervention.mjs matchedIdentity = npm:dHJpZmx1eA:10.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hub/team/intervention.mjsView on unpkg

scripts/check-codex-config-stable.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.55.1 matchedPath = scripts/check-codex-config-stable.mjs matchedIdentity = npm:dHJpZmx1eA:10.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/check-codex-config-stable.mjsView on unpkg

scripts/lib/mcp-guard-engine.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.55.1 matchedPath = scripts/lib/mcp-guard-engine.mjs matchedIdentity = npm:dHJpZmx1eA:10.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/lib/mcp-guard-engine.mjsView on unpkg

scripts/lib/tmr-install.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.55.1 matchedPath = scripts/lib/tmr-install.mjs matchedIdentity = npm:dHJpZmx1eA:10.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/lib/tmr-install.mjsView on unpkg

scripts/release/resolve-auto-release.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.55.1 matchedPath = scripts/release/resolve-auto-release.mjs matchedIdentity = npm:dHJpZmx1eA:10.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release/resolve-auto-release.mjsView on unpkg

hub/lib/codex-session-registry.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.55.1 matchedPath = hub/lib/codex-session-registry.mjs matchedIdentity = npm:dHJpZmx1eA:10.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hub/lib/codex-session-registry.mjsView on unpkg

Source & flagged code

25 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/tfx-live.mjsView file

1#!/usr/bin/env node L2: import { execFile } from "node:child_process"; L3: import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = triflux@10.55.1 matchedPath = bin/tfx-live.mjs matchedIdentity = npm:dHJpZmx1eA:10.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/tfx-live.mjsView on unpkg

Findings

1 Critical20 High6 Medium5 Low

CriticalAi Agent Control Hijackscripts/setup.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/tfx-live.mjs

HighShellbin/triflux.mjs

HighExternal Ai Agent Control Surface Mutationscripts/mcp-check.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/ensure-codex-hooks.mjs

HighTrigger Reachable Persistencescripts/setup.mjs

HighRuntime Package Installbin/triflux.mjs

HighSemantic Analysis Limitedhub/team/headless.mjs#virtual:normalized:round1

HighKnown Malware Source Similarityhub/team/headless.mjs

HighKnown Malware Source Similarityscripts/lib/legacy-mcp-cleanup.mjs

Affected versions and remediation

This report applies to triflux@10.57.3.

See all versions of triflux for other recorded verdicts.

Review the evidence and your use of triflux@10.57.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 16:33:52.580Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code