registry / triflux / 10.76.1

triflux@10.76.1

CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The postinstall prepares Codex hooks without affirmative approval during noninteractive installation, creating an agent extension lifecycle risk. Source shows that the hooks remain untrusted pending Codex approval and record session metadata locally, so the evidence supports a warning rather than a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through npm runs its postinstall; the configured hooks can run on later Codex session and prompt events after approval.

Impact

This changes the user’s Codex configuration and enables later local session tracking if the hooks are approved. No network transfer or account action was identified in the reviewed behavior.

Mechanism

Setup writes session-start and prompt-submit hook entries. When invoked, the hook records session, working-directory, and terminal metadata to a local registry.

AI rationale

Evidence

package.jsonscripts/setup.mjsscripts/ensure-codex-hooks.mjshooks/codex-session-hook.mjshub/lib/codex-session-registry.mjs~/.codex/hooks.json~/.codex/config.toml~/.local/state/triflux/codex-sessions/

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The npm postinstall starts the deferred setup flow from scripts/setup.mjs.
Setup adds Codex SessionStart and UserPromptSubmit hooks and updates Codex hook configuration.
The hook installer does not preapprove the hooks; it leaves approval to Codex, and setup defers approval when it cannot ask the user.
When run, the hook records Codex session and terminal metadata in a local registry.
The supplied CLI, cleanup, MCP, model-resolver, and live-CLI excerpts concern local configuration or state; those excerpts do not establish credential transfer or account changes.

Evidence against

The hooks are first-party package functionality, and their recorded session metadata is written locally.
The inspected installer leaves the hooks untrusted until Codex prompts for approval.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

Source & flagged code

25 flagged

package.jsonView file

Lines 1-37json

2 "name": "triflux",

3 "version": "10.76.1",

4 "description": "CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude",

5 "type": "module",

6 "bin": {

7 "triflux": "bin/triflux.mjs",

8 "tfx": "bin/triflux.mjs",

9 "tfx-live": "bin/tfx-live.mjs",

10 "tfx-setup": "bin/tfx-setup.mjs",

11 "tfx-doctor": "bin/tfx-doctor.mjs"

12 },

13 "engines": {

14 "node": ">=22"

15 },

16 "scripts": {

17 "postinstall": "node scripts/setup.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

18 },

19 "dependencies": {

20 "@iarna/toml": "^2.2.5"

21 },

22 "files": [

23 "adapters",

24 "bin",

25 "config",

26 ".claude/rules/tfx-routing.md",

27 "skills",

28 "!skills/tfx-workspace",

29 "hooks",

30 "hud",

31 "scripts",

32 "!scripts/__tests__",

33 "hub",

34 "docs/assets/logo-dark.svg",

35 "docs/assets/logo-light.svg",

36 "docs/assets/social-preview.png",

37 "docs/assets/social-preview.svg",

bin/tfx-live.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFile } from "node:child_process";

3import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

4import {

5 existsSync,

bin/triflux.mjsView file

Lines 1517-1557javascript

1517 report.alreadyInGoalState = false;

1518 }

1519 } else

1520 addWarning(report, "statusline", "HUD 파일 없음: 먼저 파일 동기화 필요");

1521

1522 const consent =

scripts/lib/install-retire.mjsView file

Lines 29-69javascript

29 /^synapse-sessions\.json$/,

30 /^team-native-.+\.json$/,

31];

32// 토큰 사본은 보관하지 않고 바로 지운다.

33const

scripts/setup.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

3// triflux 설치 및 업데이트 설정 스크립트

4// - tfx-route.sh를 ~/.claude/scripts/에 동기화

5// - hud-qos-status.mjs를 ~/.claude/hud/에 동기화

6// - skills/를 ~/.claude/skills/에 동기화

8import { createHash } from "node:crypto";

9import { execFileSync, spawn } from

scripts/mcp-check.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: , config)); } } } for (const mcpjson of scanpluginsmcpjson()) { for (const { name, config } of extractmcpservernames(mcpjson)) { if (!servermap.has(name)) { servermap.set(name, createserverrecord(name, "configured", config)); } } } for (const settingsfile of ["settings.json", "settings.local.json"]) { const data = readjsonsafe(join(claude_dir, settingsfile)); if (!data?.mcpservers) continue; for (const [name, config] of object.entries(data.mcpservers)) { if (typeof name !== "string" || !name.trim()) continue; if (!servermap.has(n

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/mcp-check.mjsView on unpkg

scripts/ensure-codex-hooks.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nction mergehooksstate(content, entries, hookspath) { const managedkeys = new set(entries.map((entry) => entry.key)); if (hooksstateconverged(content, entries, hookspath)) { return content; } return appendstateblocks( stripmanagedstatelines(content, managedkeys, hookspath), entries, ); }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/ensure-codex-hooks.mjsView on unpkg

scripts/lib/codex-recovery.shView file

•path = scripts/lib/codex-recovery.sh kind = build_helper sizeBytes = 3399 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/lib/codex-recovery.shView on unpkg

hub/team/headless.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hub/team/headless.mjs#virtual:normalized:round1View on unpkg

hub/team/headless.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.76.0 matchedPath = hub/team/headless.mjs matchedIdentity = npm:dHJpZmx1eA:10.76.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High