registry / triflux / 10.66.0

triflux@10.66.0

CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Automatic postinstall setup installs package-owned agent skills, creating an agent extension lifecycle risk. The inspected code does not establish credential disclosure or another concrete attack, so this warrants a warning rather than a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through npm, which invokes its postinstall script.

Impact

Package-provided agent skills may be installed automatically, while Codex hook trust requires a separate user action.

Mechanism

The setup flow synchronizes package skills and registers Codex hooks. The hook registration is not trusted automatically; noninteractive setup defers approval.

AI rationale

Evidence

package.jsonscripts/setup.mjsscripts/ensure-codex-hooks.mjs~/.claude/skills~/.codex/hooks.json

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs scripts/setup.mjs from an automatic postinstall hook.
For registry installs, the setup entrypoint invokes runDeferred; that flow synchronizes package skills before the later consent steps.
Skill synchronization copies package-provided skills into the user’s Claude skills directory and also handles Codex managed skills.
Setup registers first-party Codex session and prompt hooks without marking them trusted; noninteractive setup defers approval for an explicit user action.
The supplied integration locations resolve to local home-directory or configuration paths, rather than showing credential transfer or an external recipient.

Evidence against

The inspected hook approval flow requires an affirmative prompt to mark Codex hooks trusted; noninteractive setup defers that approval.
The inspected source supports an automatic first-party agent setup capability, but does not establish a concrete malicious action or credential disclosure.

Behavioral surface

Source

ChildProcessCryptoDynamicRequire

Source & flagged code

25 flagged

package.jsonView file

Lines 1-37json

2 "name": "triflux",

3 "version": "10.66.0",

4 "description": "CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude",

5 "type": "module",

6 "bin": {

7 "triflux": "bin/triflux.mjs",

8 "tfx": "bin/triflux.mjs",

9 "tfx-live": "bin/tfx-live.mjs",

10 "tfx-setup": "bin/tfx-setup.mjs",

11 "tfx-doctor": "bin/tfx-doctor.mjs"

12 },

13 "engines": {

14 "node": ">=22"

15 },

16 "scripts": {

17 "postinstall": "node scripts/setup.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

18 },

19 "dependencies": {

20 "@iarna/toml": "^2.2.5"

21 },

22 "files": [

23 "adapters",

24 "bin",

25 "config",

26 ".claude/rules/tfx-routing.md",

27 "skills",

28 "!skills/tfx-workspace",

29 "hooks",

30 "hud",

31 "scripts",

32 "!scripts/__tests__",

33 "hub",

34 "docs/assets/logo-dark.svg",

35 "docs/assets/logo-light.svg",

36 "docs/assets/social-preview.png",

37 "docs/assets/social-preview.svg",

bin/tfx-live.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFile } from "node:child_process";

3import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

4import {

5 existsSync,

bin/triflux.mjsView file

Lines 1502-1542javascript

1502 persistSettings(settings, settingsPath);

1503 report.alreadyInGoalState = false;

1504 }

1505 } else

1506 addWarning(report, "statusline", "HUD 파일 없음: 먼저 파일 동기화 필요");

1507

1508

scripts/lib/install-retire.mjsView file

Lines 29-69javascript

29 /^synapse-sessions\.json$/,

30 /^team-native-.+\.json$/,

31];

32// 토큰 사본은 보관하지 않고 바로 지운다.

33const

scripts/setup.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

3// triflux 설치 및 업데이트 설정 스크립트

4// - tfx-route.sh를 ~/.claude/scripts/에 동기화

5// - hud-qos-status.mjs를 ~/.claude/hud/에 동기화

6// - skills/를 ~/.claude/skills/에 동기화

8import { createHash } from "node:crypto";

9import { execFileSync, spawn } from

scripts/mcp-check.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: , config)); } } } for (const mcpjson of scanpluginsmcpjson()) { for (const { name, config } of extractmcpservernames(mcpjson)) { if (!servermap.has(name)) { servermap.set(name, createserverrecord(name, "configured", config)); } } } for (const settingsfile of ["settings.json", "settings.local.json"]) { const data = readjsonsafe(join(claude_dir, settingsfile)); if (!data?.mcpservers) continue; for (const [name, config] of object.entries(data.mcpservers)) { if (typeof name !== "string" || !name.trim()) continue; if (!servermap.has(n

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/mcp-check.mjsView on unpkg

scripts/ensure-codex-hooks.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nction mergehooksstate(content, entries, hookspath) { const managedkeys = new set(entries.map((entry) => entry.key)); if (hooksstateconverged(content, entries, hookspath)) { return content; } return appendstateblocks( stripmanagedstatelines(content, managedkeys, hookspath), entries, ); }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/ensure-codex-hooks.mjsView on unpkg

scripts/lib/codex-recovery.shView file

•path = scripts/lib/codex-recovery.sh kind = build_helper sizeBytes = 3399 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/lib/codex-recovery.shView on unpkg

hub/team/headless.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hub/team/headless.mjs#virtual:normalized:round1View on unpkg

hub/team/headless.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.55.1 matchedPath = hub/team/headless.mjs matchedIdentity = npm:dHJpZmx1eA:10.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High