troxy-cli@1.29.19: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

troxy-cli@1.29.19: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/check-node.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/troxy.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = troxy-cli@1.29.10 matchedIdentity = npm:dHJveHktY2xp:1.29.10 similarity = 0.776 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/troxy.jsView on unpkg

541case 'restart': { L542: const { execSync: _execSyncRestart } = await import('child_process'); L543: const fsR = await import('fs');

High

Child Process

Package source references child process execution.

bin/troxy.jsView on unpkg · L541

69Trigger-reachable persistence chain: manifest.bin -> bin/troxy.js L69: const { createRequire } = await import('module'); L70: const { version } = createRequire(import.meta.url)('../package.json'); L71: process.stdout.write(version); L72: try { ... L97: } L98: const apiKey = loadConfig()?.apiKey || process.env.TROXY_API_KEY; L99: if (!apiKey) { ... L108: await runToolDetection(apiKey); L109: console.log(' Saved ✓ See it at https://dash.troxy.io\n'); L110: break; ... L138: } = await import('../src/init.js'); L139: const dir = process.cwd();

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/troxy.jsView on unpkg · L69

622try { L623: execSync('npm install -g troxy-cli@latest', { stdio: 'pipe' }); L624: } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/troxy.jsView on unpkg · L622

69const { createRequire } = await import('module'); L70: const { version } = createRequire(import.meta.url)('../package.json'); L71: process.stdout.write(version); L72: try { ... L97: } L98: const apiKey = loadConfig()?.apiKey || process.env.TROXY_API_KEY; L99: if (!apiKey) { ... L108: await runToolDetection(apiKey); L109: console.log(' Saved ✓ See it at https://dash.troxy.io\n'); L110: break; ... L138: } = await import('../src/init.js'); L139: const dir = process.cwd();

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/troxy.jsView on unpkg · L69

src/mcp-server.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/mcp-server.js#virtual:normalized:round1View on unpkg

src/auth.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/auth.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/auth.jsView on unpkg

src/tool_detect.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/tool_detect.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tool_detect.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "troxy-cli",

3 "version": "1.29.19",

4 "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",

5 "homepage": "https://troxy.io",

6 "bugs": {

7 "email": "support@troxy.io"

8 },

9 "type": "module",

10 "bin": {

11 "troxy": "bin/troxy.js"

12 },

13 "scripts": {

14 "preinstall": "node scripts/check-node.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

15 "test": "node --test src/tests/*.test.js"

16 },

17 "dependencies": {

18 "@modelcontextprotocol/sdk": "^1.30.0",

19 "node-forge": "^1.4.0"

20 },

21 "overrides": {

22 "fast-uri": "^3.1.6",

23 "ip-address": "^10.3.1",

24 "hono": "^4.13.8",

25 "qs": "^6.16.0",

26 "body-parser": "^2.3.0",

27 "@hono/node-server": "^1.19.17"

28 },

29 "engines": {

30 "node": ">=18"

31 },

32 "files": [

33 "bin/",

34 "src/",

bin/troxy.jsView file

Lines 49-89javascript

49 // JWT-based command — session expired or not logged in

50 console.error('\n Session expired or not logged in. Run: troxy login\n');

51 } else if (source === 'config') {

52 console.error('

src/mcp-server.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/mcp-server.js#virtual:normalized:round1View on unpkg

src/auth.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/auth.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/auth.jsView on unpkg

src/tool_detect.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/tool_detect.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tool_detect.jsView on unpkg

Lines 521-561javascript

521 }

522 console.log();

523 }

524

525 // Version check

526 try {

527 const { createRequire } = await import('module');

528 const require = createRequire(import.meta.url);

529 const { version: current } = require('../package.json');

530 const latest = await checkLatestVersion();

531 if (current !== latest) {

532 console.log(` ⚠ New version available: ${latest} (you have ${current})`);

533 console.log(` Run: troxy update\n`);

534 }

535 } catch {}

536

537 break;

538 }

539

540 // ── Restart MCP service ───────────────────────────────────────

541 case 'restart': {

542 const { execSync: _execSyncRestart } = await import('child_process');

543 const fsR = await import('fs');

High

Child Process

Package source references child process execution.

bin/troxy.jsView on unpkg · L541

544 const osR = (await import('os')).default;

545 console.log('\n Restarting Troxy service...');

546 try {

547 if (osR.platform() === 'linux') {

548 // Migrate service file from old "troxy mcp" to "troxy daemon" if needed

549 const svcPath = '/etc/systemd/system/troxy-mcp.service';

550 if (fsR.existsSync(svcPath)) {

551 const svc = fsR.readFileSync(svcPath, 'utf8');

552 if (svc.includes('ExecStart=') && svc.includes(' mcp') && !svc.includes(' daemon')) {

553 const fixed = svc.replace(/(ExecStart=\S+) mcp/, '$1 daemon');

554 fsR.writeFileSync('/tmp/troxy-mcp.service', fixed);

555 _execSyncRestart('sudo mv /tmp/troxy-mcp.service /etc/systemd/system/troxy-mcp.service');

556 _execSyncRestart('sudo systemctl daemon-reload');

557 process.stdout.write(' Migrated service to daemon mode ✓\n');

558 }

559 }

560 _execSyncRestart('sudo systemctl restart troxy-mcp', { stdio: 'inherit' });

561 } else if (osR.platform() === 'darwin') {

Lines 602-642javascript

602 // moved. For a cloud agent the package is beside the point: what goes stale

603 // is its picture of which checkpoints exist, and that lives on the server.

604 // This is a no-op on a machine with an MCP client, which gets a fresh tool

605 // list from the MCP handshake every session anyway.

606 const { refreshHostedInstructions } = await import('../src/init.js');

607 const refresh = async () => {

608 try {

609 return await refreshHostedInstructions((loadConfig() || {}).apiKey);

610 } catch { return false; }

611 };

612

613 if (current === latest) {

614 console.log(`already up to date (${current})`);

615 if (!await refresh()) console.log('');

616 break;

617 }

618

619 console.log(`${current} → ${latest}`);

620 process.stdout.write(' Installing... ');

621 try {

622 try {

623 execSync('npm install -g troxy-cli@latest', { stdio: 'pipe' });

624 } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/troxy.jsView on unpkg · L622

625 const stderr = err.stderr?.toString() || '';

626 if (stderr.includes('ENOTEMPTY')) {

627 // npm bug on macOS/Homebrew: rename fails because dir has contents.

628 // rm -rf the stale dir directly, then reinstall cleanly.

629 const globalRoot = execSync('npm root -g', { stdio: 'pipe' }).toString().trim();

630 execSync(`rm -rf "${globalRoot}/troxy-cli" && npm install -g troxy-cli@latest`, { stdio: 'pipe', shell: true });

631 } else {

632 throw err;

633 }

634 }

635 // Also refresh the npx cache so MCP servers (e.g. OpenClaw) pick up the new version

636 try { execSync(`npx --yes troxy-cli@${latest} --version`, { stdio: 'pipe' }); } catch { /* non-fatal */ }

637 console.log(`✓\n\n Updated to ${latest}.`);

638

639 // Re-run the exact same client/hook provisioning `troxy init` does,

640 // using the key already saved on this machine - a version bump can

641 // change what gets registered (e.g. 1.21.0 added a PreToolUse hook

642 // alongside the existing Stop hook), and `update` silently leaving