registry / triflux / 10.65.0

triflux@10.65.0

CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The automatic setup includes first-party agent configuration and hook registration, creating a concrete lifecycle integration risk. Consent gates and the absence of an inspected exfiltration or foreign control-surface attack support a warning rather than a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through npm triggers its postinstall script.

Impact

Package-owned integration behavior may alter local agent configuration and add hooks that run in later sessions or on prompt submission.

Mechanism

The setup script applies Claude settings, registers Codex hooks, and cleans up legacy hooks; optional installations and Codex hook approval have consent prompts.

AI rationale

Evidence

package.jsonscripts/setup.mjsscripts/ensure-codex-hooks.mjsClaude and Codex user configuration paths

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs scripts/setup.mjs automatically after installation.
The postinstall setup changes Claude settings and ensures Codex hooks are registered; it also cleans up legacy Antigravity hooks.
The Codex hook setup defines session-start and prompt-submit hooks that run package scripts.
Setup requires explicit consent for optional installs and Codex hook approval, but the hook registration path also runs during postinstall without that approval.
The indicated integration locations read or store session, cache, task, or diagnostic data; these excerpts do not establish credential exfiltration or a foreign control-surface attack.

Evidence against

The setup code identifies Codex hook approval and optional installs as consent-gated, and defers when interaction is unavailable.
Inspected integration excerpts show local configuration and data paths without a credential send operation or unrelated remote endpoint.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVars

Source & flagged code

25 flagged

package.jsonView file

Lines 1-37json

2 "name": "triflux",

3 "version": "10.65.0",

4 "description": "CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude",

5 "type": "module",

6 "bin": {

7 "triflux": "bin/triflux.mjs",

8 "tfx": "bin/triflux.mjs",

9 "tfx-live": "bin/tfx-live.mjs",

10 "tfx-setup": "bin/tfx-setup.mjs",

11 "tfx-doctor": "bin/tfx-doctor.mjs"

12 },

13 "engines": {

14 "node": ">=22"

15 },

16 "scripts": {

17 "postinstall": "node scripts/setup.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

18 },

19 "dependencies": {

20 "@iarna/toml": "^2.2.5"

21 },

22 "files": [

23 "adapters",

24 "bin",

25 "config",

26 ".claude/rules/tfx-routing.md",

27 "skills",

28 "!skills/tfx-workspace",

29 "hooks",

30 "hud",

31 "scripts",

32 "!scripts/__tests__",

33 "hub",

34 "docs/assets/logo-dark.svg",

35 "docs/assets/logo-light.svg",

36 "docs/assets/social-preview.png",

37 "docs/assets/social-preview.svg",

bin/tfx-live.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFile } from "node:child_process";

3import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

4import {

5 existsSync,

bin/triflux.mjsView file

Lines 1502-1542javascript

1502 persistSettings(settings, settingsPath);

1503 report.alreadyInGoalState = false;

1504 }

1505 } else

1506 addWarning(report, "statusline", "HUD 파일 없음: 먼저 파일 동기화 필요");

1507

1508

scripts/lib/install-retire.mjsView file

Lines 29-69javascript

29 /^synapse-sessions\.json$/,

30 /^team-native-.+\.json$/,

31];

32// 토큰 사본은 보관하지 않고 바로 지운다.

33const

scripts/setup.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

3// triflux 설치 및 업데이트 설정 스크립트

4// - tfx-route.sh를 ~/.claude/scripts/에 동기화

5// - hud-qos-status.mjs를 ~/.claude/hud/에 동기화

6// - skills/를 ~/.claude/skills/에 동기화

8import { createHash } from "node:crypto";

9import { execFileSync, spawn } from

scripts/mcp-check.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: , config)); } } } for (const mcpjson of scanpluginsmcpjson()) { for (const { name, config } of extractmcpservernames(mcpjson)) { if (!servermap.has(name)) { servermap.set(name, createserverrecord(name, "configured", config)); } } } for (const settingsfile of ["settings.json", "settings.local.json"]) { const data = readjsonsafe(join(claude_dir, settingsfile)); if (!data?.mcpservers) continue; for (const [name, config] of object.entries(data.mcpservers)) { if (typeof name !== "string" || !name.trim()) continue; if (!servermap.has(n

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/mcp-check.mjsView on unpkg

scripts/ensure-codex-hooks.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nction mergehooksstate(content, entries, hookspath) { const managedkeys = new set(entries.map((entry) => entry.key)); if (hooksstateconverged(content, entries, hookspath)) { return content; } return appendstateblocks( stripmanagedstatelines(content, managedkeys, hookspath), entries, ); }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/ensure-codex-hooks.mjsView on unpkg

scripts/lib/codex-recovery.shView file

•path = scripts/lib/codex-recovery.sh kind = build_helper sizeBytes = 3399 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/lib/codex-recovery.shView on unpkg

hub/team/headless.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hub/team/headless.mjs#virtual:normalized:round1View on unpkg

hub/team/headless.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.55.1 matchedPath = hub/team/headless.mjs matchedIdentity = npm:dHJpZmx1eA:10.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High