triflux@10.59.1
CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe lifecycle hook performs package-owned agent setup and can update an existing Gemini profile configuration, so it presents a guarded agent extension lifecycle risk. The inspected source does not establish an active attack or justify blocking publication.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Installing the package through npm runs its postinstall hook.
Impact
An existing agent configuration may be updated during installation; the inspected behavior does not establish credential theft or a broader control-surface attack.
Mechanism
The hook invokes scripts/setup.mjs, whose setup path may add Gemini profiles when the user's Gemini directory already exists; optional tool installs and Codex hook approval require consent.
AI rationale
The lifecycle hook performs package-owned agent setup and can update an existing Gemini profile configuration, so it presents a guarded agent extension lifecycle risk. The inspected source does not establish an active attack or justify blocking publication.
Evidence
package.jsonscripts/setup.mjs
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs scripts/setup.mjs automatically during postinstall.
- Installed copies run setup from postinstall; checkout postinstalls follow a separate path.
- Postinstall setup may add Gemini profiles when a Gemini configuration already exists.
- Optional tool installation and Codex hook approval are gated on user consent.
- Triflux mods inspection skips postinstall.
Evidence against
- The inspected setup behavior is package-aligned configuration work; no unrelated control-surface mutation, credential exfiltration, or remote payload execution was established.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
25 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/setup.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/tfx-live.mjsView file
1#!/usr/bin/env node
L2: import { execFile } from "node:child_process";
L3: import { randomBytes } from "node:crypto";
High
•matchType = normalized_sha256
matchedPackage = triflux@10.55.1
matchedPath = bin/tfx-live.mjs
matchedIdentity = npm:dHJpZmx1eA:10.55.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/tfx-live.mjsView on unpkgFindings
1 Critical20 High6 Medium5 Low
CriticalAi Agent Control Hijackscripts/setup.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/tfx-live.mjs
HighShellbin/triflux.mjs
HighExternal Ai Agent Control Surface Mutationscripts/mcp-check.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/ensure-codex-hooks.mjs
HighTrigger Reachable Persistencescripts/setup.mjs
HighRuntime Package Installbin/triflux.mjs
HighSemantic Analysis Limitedhub/team/headless.mjs#virtual:normalized:round1
HighKnown Malware Source Similarityhub/team/headless.mjs
HighKnown Malware Source Similarityscripts/lib/legacy-mcp-cleanup.mjs
Affected versions and remediation
This report applies to triflux@10.59.1.
See all versions of triflux for other recorded verdicts.
- Review the evidence and your use of triflux@10.59.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.