registry / triflux / 10.69.0

triflux@10.69.0

CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The lifecycle hook makes package-owned agent setup run automatically and modify user configuration, so this warrants a warning. Source inspection did not establish a block-eligible attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through npm, which runs its postinstall hook.

Impact

User agent configuration and installed integration files may change during package installation.

Mechanism

scripts/setup.mjs runs deferred setup and synchronizes package files; it also registers Codex hooks while leaving them untrusted.

AI rationale

The lifecycle hook makes package-owned agent setup run automatically and modify user configuration, so this warrants a warning. Source inspection did not establish a block-eligible attack.

Evidence

package.jsonscripts/setup.mjsscripts/ensure-codex-hooks.mjs~/.claude~/.codex

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs scripts/setup.mjs during postinstall, and the installed-package path runs runDeferred.
Setup synchronizes package files into user directories before running its consent steps.
Setup calls ensureCodexHooks, which writes Codex hook configuration; the source says hook trust is not granted automatically.
The other indicated paths concern local configuration, legacy cleanup, model state, or CLI usage and do not establish a separate account action or credential transfer.

Evidence against

The Codex hook trust state is not automatically approved.
The inspected lifecycle path showed no unrelated credential recipient or verified account mutation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

25 flagged

package.jsonView file

•scripts.postinstall = node scripts/setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/tfx-live.mjsView file

1#!/usr/bin/env node L2: import { execFile } from "node:child_process"; L3: import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

bin/triflux.mjsView file

1523}); L1524: // ── psmux 기본 셸 자동 수정 (cmd.exe → PowerShell) ── L1525: if (process.platform === "win32" && which("psmux")) {

High

Shell

Package source references shell execution.

bin/triflux.mjsView on unpkg · L1523

1385} = {}) { L1386: const command = "npm install -g triflux@latest"; L1387: const options = { ... L1393: try { L1394: exec(command, options); L1395: } catch (error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/triflux.mjsView on unpkg · L1385

2883findFsmonitorDaemons, L2884: } = await import("../hub/lib/process-utils.mjs"); L2885: if (fix) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/triflux.mjsView on unpkg · L2883

scripts/lib/install-retire.mjsView file

49try { L50: return new Set(JSON.parse(readFileSync(HISTORY_FILE, "utf8"))); L51: } catch {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/lib/install-retire.mjsView on unpkg · L49

scripts/setup.mjsView file

3// triflux 설치 및 업데이트 설정 스크립트 L4: // - tfx-route.sh를 ~/.claude/scripts/에 동기화 L5: // - hud-qos-status.mjs를 ~/.claude/hud/에 동기화 L6: // - skills/를 ~/.claude/skills/에 동기화 L7: ... L11: chmodSync, L12: copyFileSync, L13: cpSync, L14: existsSync, L15: mkdirSync, L16: readdirSync, ... L22: unlinkSync,

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/setup.mjsView on unpkg · L3

8Trigger-reachable persistence chain: scripts.postinstall -> scripts/setup.mjs L8: import { createHash } from "node:crypto"; L9: import { execFileSync, spawn } from "child_process"; L10: import { ... L70: const PLUGIN_ROOT = dirname(dirname(fileURLToPath(import.meta.url))); L71: // home 해석은 scripts/lib/machine-profile.mjs 가 정본이다. Windows 의 os.homedir() L72: // 가 process.env.HOME swap 을 무시해 fixture 격리한 자식 프로세스가 실제 홈을 L73: // 건드리던 문제(#193 회귀)까지 그 모듈이 담고 있다. ... L86: function commandAvailableOnPath(command, { env = process.env, platform } = {}) { L87: const selectedPlatform = platform || process.platform; L88: if (command.includes("/") || command.includes("\\")) { ... L230: if (["n", "no", "0"].includes(answer)) return false; L231: output.write(" y 또는 n으로 입력하세요.\n");

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/setup.mjsView on unpkg · L8

8import { createHash } from "node:crypto"; L9: import { execFileSync, spawn } from "child_process"; L10: import { ... L70: const PLUGIN_ROOT = dirname(dirname(fileURLToPath(import.meta.url))); L71: // home 해석은 scripts/lib/machine-profile.mjs 가 정본이다. Windows 의 os.homedir() L72: // 가 process.env.HOME swap 을 무시해 fixture 격리한 자식 프로세스가 실제 홈을 L73: // 건드리던 문제(#193 회귀)까지 그 모듈이 담고 있다. ... L86: function commandAvailableOnPath(command, { env = process.env, platform } = {}) { L87: const selectedPlatform = platform || process.platform; L88: if (command.includes("/") || command.includes("\\")) { ... L230: if (["n", "no", "0"].includes(answer)) return false; L231: output.write(" y 또는 n으로 입력하세요.\n");

scripts/mcp-check.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: , config)); } } } for (const mcpjson of scanpluginsmcpjson()) { for (const { name, config } of extractmcpservernames(mcpjson)) { if (!servermap.has(name)) { servermap.set(name, createserverrecord(name, "configured", config)); } } } for (const settingsfile of ["settings.json", "settings.local.json"]) { const data = readjsonsafe(join(claude_dir, settingsfile)); if (!data?.mcpservers) continue; for (const [name, config] of object.entries(data.mcpservers)) { if (typeof name !== "string" || !name.trim()) continue; if (!servermap.has(n

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/mcp-check.mjsView on unpkg

scripts/ensure-codex-hooks.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nction mergehooksstate(content, entries, hookspath) { const managedkeys = new set(entries.map((entry) => entry.key)); if (hooksstateconverged(content, entries, hookspath)) { return content; } return appendstateblocks( stripmanagedstatelines(content, managedkeys, hookspath), entries, ); }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/ensure-codex-hooks.mjsView on unpkg

scripts/lib/codex-recovery.shView file

•path = scripts/lib/codex-recovery.sh kind = build_helper sizeBytes = 3399 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/lib/codex-recovery.shView on unpkg

hub/team/headless.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hub/team/headless.mjs#virtual:normalized:round1View on unpkg

hub/team/headless.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.55.1 matchedPath = hub/team/headless.mjs matchedIdentity = npm:dHJpZmx1eA:10.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High