registry / triflux / 10.73.0

triflux@10.73.0

CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The package automatically registers a first-party Codex session hook during installation, creating an agent integration lifecycle risk. Its trust is not automatically granted, and the inspected hook records session data locally, so the source supports a warning rather than a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package from its installed copy triggers postinstall setup.

Impact

After trust approval, Codex can run the hook on session events, allowing Triflux to maintain local session records.

Mechanism

Setup writes the package-owned hook into the user's Codex hook configuration; the hook handles session events and writes records to a local Triflux registry.

AI rationale

Evidence

package.jsonscripts/setup.mjsscripts/ensure-codex-hooks.mjshooks/codex-session-hook.mjshub/lib/codex-session-registry.mjs

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs setup automatically after installation, and the installed setup script dispatches to its deferred setup path.
Deferred setup invokes Codex hook registration without granting trust; approval is deferred in noninteractive setup or requires an affirmative prompt.
The registered hook records session data in Triflux's local session registry.
The other inspected integration targets concern local configuration, cleanup, model settings, or local report storage; they did not establish another attack chain.

Evidence against

The hook does not receive automatic trust approval; setup defers trust in noninteractive mode.
The inspected hook records session data locally.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

25 flagged

package.jsonView file

•scripts.postinstall = node scripts/setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/tfx-live.mjsView file

1#!/usr/bin/env node L2: import { execFile } from "node:child_process"; L3: import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

bin/triflux.mjsView file

1530}); L1531: // ── psmux 기본 셸 자동 수정 (cmd.exe → PowerShell) ── L1532: if (process.platform === "win32" && which("psmux")) {

High

Shell

Package source references shell execution.

bin/triflux.mjsView on unpkg · L1530

1385} = {}) { L1386: const command = "npm install -g triflux@latest"; L1387: const options = { ... L1393: try { L1394: exec(command, options); L1395: } catch (error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/triflux.mjsView on unpkg · L1385

2890findFsmonitorDaemons, L2891: } = await import("../hub/lib/process-utils.mjs"); L2892: if (fix) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/triflux.mjsView on unpkg · L2890

scripts/lib/install-retire.mjsView file

49try { L50: return new Set(JSON.parse(readFileSync(HISTORY_FILE, "utf8"))); L51: } catch {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/lib/install-retire.mjsView on unpkg · L49

scripts/setup.mjsView file

3// triflux 설치 및 업데이트 설정 스크립트 L4: // - tfx-route.sh를 ~/.claude/scripts/에 동기화 L5: // - hud-qos-status.mjs를 ~/.claude/hud/에 동기화 L6: // - skills/를 ~/.claude/skills/에 동기화 L7: ... L11: chmodSync, L12: copyFileSync, L13: cpSync, L14: existsSync, L15: mkdirSync, L16: readdirSync, ... L22: unlinkSync,

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/setup.mjsView on unpkg · L3

8Trigger-reachable persistence chain: scripts.postinstall -> scripts/setup.mjs L8: import { createHash } from "node:crypto"; L9: import { execFileSync, spawn } from "child_process"; L10: import { ... L70: const PLUGIN_ROOT = dirname(dirname(fileURLToPath(import.meta.url))); L71: // home 해석은 scripts/lib/machine-profile.mjs 가 정본이다. Windows 의 os.homedir() L72: // 가 process.env.HOME swap 을 무시해 fixture 격리한 자식 프로세스가 실제 홈을 L73: // 건드리던 문제(#193 회귀)까지 그 모듈이 담고 있다. ... L86: function commandAvailableOnPath(command, { env = process.env, platform } = {}) { L87: const selectedPlatform = platform || process.platform; L88: if (command.includes("/") || command.includes("\\")) { ... L230: if (["n", "no", "0"].includes(answer)) return false; L231: output.write(" y 또는 n으로 입력하세요.\n");

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/setup.mjsView on unpkg · L8

8import { createHash } from "node:crypto"; L9: import { execFileSync, spawn } from "child_process"; L10: import { ... L70: const PLUGIN_ROOT = dirname(dirname(fileURLToPath(import.meta.url))); L71: // home 해석은 scripts/lib/machine-profile.mjs 가 정본이다. Windows 의 os.homedir() L72: // 가 process.env.HOME swap 을 무시해 fixture 격리한 자식 프로세스가 실제 홈을 L73: // 건드리던 문제(#193 회귀)까지 그 모듈이 담고 있다. ... L86: function commandAvailableOnPath(command, { env = process.env, platform } = {}) { L87: const selectedPlatform = platform || process.platform; L88: if (command.includes("/") || command.includes("\\")) { ... L230: if (["n", "no", "0"].includes(answer)) return false; L231: output.write(" y 또는 n으로 입력하세요.\n");

scripts/mcp-check.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: , config)); } } } for (const mcpjson of scanpluginsmcpjson()) { for (const { name, config } of extractmcpservernames(mcpjson)) { if (!servermap.has(name)) { servermap.set(name, createserverrecord(name, "configured", config)); } } } for (const settingsfile of ["settings.json", "settings.local.json"]) { const data = readjsonsafe(join(claude_dir, settingsfile)); if (!data?.mcpservers) continue; for (const [name, config] of object.entries(data.mcpservers)) { if (typeof name !== "string" || !name.trim()) continue; if (!servermap.has(n

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/mcp-check.mjsView on unpkg

scripts/ensure-codex-hooks.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nction mergehooksstate(content, entries, hookspath) { const managedkeys = new set(entries.map((entry) => entry.key)); if (hooksstateconverged(content, entries, hookspath)) { return content; } return appendstateblocks( stripmanagedstatelines(content, managedkeys, hookspath), entries, ); }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/ensure-codex-hooks.mjsView on unpkg

scripts/lib/codex-recovery.shView file

•path = scripts/lib/codex-recovery.sh kind = build_helper sizeBytes = 3399 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/lib/codex-recovery.shView on unpkg

hub/team/headless.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hub/team/headless.mjs#virtual:normalized:round1View on unpkg

scripts/lib/mcp-health.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.55.1 matchedPath = scripts/lib/mcp-health.mjs matchedIdentity = npm:dHJpZmx1eA:10.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High