triflux@10.77.0
CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude
AI Security Review
scanned 7d ago · by lpm-firewall-aiSource confirms that npm postinstall reaches setup code that writes Codex hook configuration before user approval. The later Codex trust prompt limits execution but does not provide consent for the install-time configuration mutation.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Installing the package through npm, which runs its postinstall hook.
Impact
The install changes Codex's hook configuration without install-time consent. Codex approval still gates execution of the hooks.
Mechanism
Postinstall runs deferred setup; the consent flow writes Codex hook entries with trust disabled before any approval prompt.
Policy narrative
During npm installation, the postinstall setup writes session-start and prompt-submit hooks into the user's Codex configuration before asking for approval. Codex does not mark them trusted automatically and prompts before executing them, but the foreign agent control surface is already modified by the install.
AI rationale
Source confirms that npm postinstall reaches setup code that writes Codex hook configuration before user approval. The later Codex trust prompt limits execution but does not provide consent for the install-time configuration mutation.
Evidence
package.jsonscripts/setup.mjsscripts/ensure-codex-hooks.mjs~/.codex/hooks.json~/.codex/config.toml
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.
Evidence for policy risk
- The manifest runs the setup script during postinstall.
- An installed postinstall runs deferred setup, which reaches the consent steps.
- The consent flow writes Codex hook configuration with trust disabled before asking for approval.
- Setup adds SessionStart and UserPromptSubmit hooks to Codex configuration and writes the configuration file.
- Codex trust is not pre-approved; Codex prompts on first use, limiting hook execution until approval.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
25 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/setup.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/tfx-live.mjsView file
1#!/usr/bin/env node
L2: import { execFile } from "node:child_process";
L3: import { randomBytes } from "node:crypto";
High
bin/triflux.mjsView file
1540});
L1541: // ── psmux 기본 셸 자동 수정 (cmd.exe → PowerShell) ──
L1542: if (process.platform === "win32" && which("psmux")) {
High
Shell
Package source references shell execution.
Findings
1 Critical20 High6 Medium5 Low
CriticalAi Agent Control Hijackscripts/setup.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/tfx-live.mjs
HighShellbin/triflux.mjs
HighExternal Ai Agent Control Surface Mutationscripts/mcp-check.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/ensure-codex-hooks.mjs
HighTrigger Reachable Persistencescripts/setup.mjs
HighRuntime Package Installbin/triflux.mjs
HighSemantic Analysis Limitedhub/team/headless.mjs#virtual:normalized:round1
HighKnown Malware Source Similarityhub/team/headless.mjs
HighKnown Malware Source Similarityhud/providers/claude.mjs
Affected versions and remediation
This report applies to triflux@10.77.0.
See all versions of triflux for other recorded verdicts.
- Avoid installing triflux@10.77.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.