registry / triflux / 10.79.0

triflux@10.79.0

CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The postinstall performs first-party agent skill setup, and the user-invoked session launcher bypasses folder-trust confirmation by default. These behaviors warrant a warning; the source does not establish a concrete malicious attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package runs postinstall setup; later, a user starts or resumes a session where a folder-trust prompt appears.

Impact

Installed skills become available to the agent, and a launched session can proceed without a separate folder-trust confirmation.

Mechanism

Setup copies bundled Markdown skills into the Claude skills directory. The launcher recognizes trust prompts and confirms them unless `--no-auto-trust` is supplied.

AI rationale

Evidence

package.jsonscripts/setup.mjsbin/tfx-live.mjsskills/tfx-live/SKILL.md~/.claude/skills

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The npm postinstall runs setup, which syncs bundled Markdown skills into the user's Claude skills directory; npm setup cannot prompt for consent.
Setup also launches a local MCP inventory helper that writes a cache.
When a user starts a session and a Claude or Codex folder-trust prompt appears, the launcher selects the trust option and sends Enter.
The `--no-auto-trust` option makes recognized trust prompts block readiness; the package's skill documentation describes the default and this opt-out.
The other cited agent-integration locations resolve to local configuration, cache, session-index, and route-script paths.
The runtime-operation hints concern handoff display and text sanitization.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

25 flagged

package.jsonView file

Lines 1-38json

2 "name": "triflux",

3 "version": "10.79.0",

4 "description": "CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude",

5 "type": "module",

6 "bin": {

7 "triflux": "bin/triflux.mjs",

8 "tfx": "bin/triflux.mjs",

9 "tfx-live": "bin/tfx-live.mjs",

10 "tfx-peer": "bin/tfx-peer.mjs",

11 "tfx-setup": "bin/tfx-setup.mjs",

12 "tfx-doctor": "bin/tfx-doctor.mjs"

13 },

14 "engines": {

15 "node": ">=22"

16 },

17 "scripts": {

18 "postinstall": "node scripts/setup.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

19 },

20 "dependencies": {

21 "@iarna/toml": "^2.2.5"

22 },

23 "files": [

24 "adapters",

25 "bin",

26 "config",

27 ".claude/rules/tfx-routing.md",

28 "skills",

29 "!skills/tfx-workspace",

30 "hooks",

31 "hud",

32 "scripts",

33 "!scripts/__tests__",

34 "hub",

35 "docs/assets/logo-dark.svg",

36 "docs/assets/logo-light.svg",

37 "docs/assets/social-preview.png",

38 "docs/assets/social-preview.svg",

bin/tfx-live.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFile } from "node:child_process";

3import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

4import {

5 existsSync,

bin/triflux.mjsView file

Lines 1520-1560javascript

1520 report.alreadyInGoalState = false;

1521 }

1522 } else

1523 addWarning(report, "statusline", "HUD 파일 없음: 먼저 파일 동기화 필요");

1524

1525 const consent =

scripts/lib/install-retire.mjsView file

Lines 29-69javascript

29 /^synapse-sessions\.json$/,

30 /^team-native-.+\.json$/,

31];

32// 토큰 사본은 보관하지 않고 바로 지운다.

33const

scripts/setup.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

3// triflux 설치 및 업데이트 설정 스크립트

4// - tfx-route.sh를 ~/.claude/scripts/에 동기화

5// - hud-qos-status.mjs를 ~/.claude/hud/에 동기화

6// - skills/를 ~/.claude/skills/에 동기화

8import { createHash } from "node:crypto";

9import { execFileSync, spawn } from

scripts/mcp-check.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: , config)); } } } for (const mcpjson of scanpluginsmcpjson()) { for (const { name, config } of extractmcpservernames(mcpjson)) { if (!servermap.has(name)) { servermap.set(name, createserverrecord(name, "configured", config)); } } } for (const settingsfile of ["settings.json", "settings.local.json"]) { const data = readjsonsafe(join(claude_dir, settingsfile)); if (!data?.mcpservers) continue; for (const [name, config] of object.entries(data.mcpservers)) { if (typeof name !== "string" || !name.trim()) continue; if (!servermap.has(n

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/mcp-check.mjsView on unpkg

scripts/ensure-codex-hooks.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nction mergehooksstate(content, entries, hookspath) { const managedkeys = new set(entries.map((entry) => entry.key)); if (hooksstateconverged(content, entries, hookspath)) { return content; } return appendstateblocks( stripmanagedstatelines(content, managedkeys, hookspath), entries, ); }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/ensure-codex-hooks.mjsView on unpkg

scripts/lib/codex-recovery.shView file

•path = scripts/lib/codex-recovery.sh kind = build_helper sizeBytes = 3399 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/lib/codex-recovery.shView on unpkg

hub/team/headless.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hub/team/headless.mjs#virtual:normalized:round1View on unpkg

hub/team/headless.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.77.0 matchedPath = hub/team/headless.mjs matchedIdentity = npm:dHJpZmx1eA:10.77.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High