troxy-cli@1.29.21: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

troxy-cli@1.29.21: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/check-node.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/troxy.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = troxy-cli@1.29.10 matchedIdentity = npm:dHJveHktY2xp:1.29.10 similarity = 0.776 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/troxy.jsView on unpkg

552case 'restart': { L553: const { execSync: _execSyncRestart } = await import('child_process'); L554: const fsR = await import('fs');

High

Child Process

Package source references child process execution.

bin/troxy.jsView on unpkg · L552

69Trigger-reachable persistence chain: manifest.bin -> bin/troxy.js L69: const { createRequire } = await import('module'); L70: const { version } = createRequire(import.meta.url)('../package.json'); L71: process.stdout.write(version); L72: try { ... L97: } L98: const apiKey = loadConfig()?.apiKey || process.env.TROXY_API_KEY; L99: if (!apiKey) { ... L108: await runToolDetection(apiKey); L109: console.log(' Saved ✓ See it at https://dash.troxy.io\n'); L110: break; ... L138: } = await import('../src/init.js'); L139: const dir = process.cwd();

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/troxy.jsView on unpkg · L69

633try { L634: execSync('npm install -g troxy-cli@latest', { stdio: 'pipe' }); L635: } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/troxy.jsView on unpkg · L633

69const { createRequire } = await import('module'); L70: const { version } = createRequire(import.meta.url)('../package.json'); L71: process.stdout.write(version); L72: try { ... L97: } L98: const apiKey = loadConfig()?.apiKey || process.env.TROXY_API_KEY; L99: if (!apiKey) { ... L108: await runToolDetection(apiKey); L109: console.log(' Saved ✓ See it at https://dash.troxy.io\n'); L110: break; ... L138: } = await import('../src/init.js'); L139: const dir = process.cwd();

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/troxy.jsView on unpkg · L69

src/mcp-server.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/mcp-server.js#virtual:normalized:round1View on unpkg

src/auth.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/auth.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/auth.jsView on unpkg

src/tool_detect.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/tool_detect.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tool_detect.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "troxy-cli",

3 "version": "1.29.21",

4 "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",

5 "homepage": "https://troxy.io",

6 "bugs": {

7 "email": "support@troxy.io"

8 },

9 "type": "module",

10 "bin": {

11 "troxy": "bin/troxy.js"

12 },

13 "scripts": {

14 "preinstall": "node scripts/check-node.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

15 "test": "node --test src/tests/*.test.js"

16 },

17 "dependencies": {

18 "@modelcontextprotocol/sdk": "^1.30.0",

19 "node-forge": "^1.4.0"

20 },

21 "overrides": {

22 "fast-uri": "^3.1.6",

23 "ip-address": "^10.3.1",

24 "hono": "^4.13.8",

25 "qs": "^6.16.0",

26 "body-parser": "^2.3.0",

27 "@hono/node-server": "^1.19.17"

28 },

29 "engines": {

30 "node": ">=18"

31 },

32 "files": [

33 "bin/",

34 "src/",

bin/troxy.jsView file

Lines 49-89javascript

49 // JWT-based command — session expired or not logged in

50 console.error('\n Session expired or not logged in. Run: troxy login\n');

51 } else if (source === 'config') {

52 console.error('

src/mcp-server.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/mcp-server.js#virtual:normalized:round1View on unpkg

src/auth.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/auth.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/auth.jsView on unpkg

src/tool_detect.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/tool_detect.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tool_detect.jsView on unpkg

Lines 532-572javascript

532 } else {

533 console.log(' Account: not signed in. Run `troxy login` to manage policies and view activity from the CLI.\n');

534 }

535

536 // Version check

537 try {

538 const { createRequire } = await import('module');

539 const require = createRequire(import.meta.url);

540 const { version: current } = require('../package.json');

541 const latest = await checkLatestVersion();

542 if (current !== latest) {

543 console.log(` ⚠ New version available: ${latest} (you have ${current})`);

544 console.log(` Run: troxy update\n`);

545 }

546 } catch {}

547

548 break;

549 }

550

551 // ── Restart MCP service ───────────────────────────────────────

552 case 'restart': {

553 const { execSync: _execSyncRestart } = await import('child_process');

554 const fsR = await import('fs');

High

Child Process

Package source references child process execution.

bin/troxy.jsView on unpkg · L552

555 const osR = (await import('os')).default;

556 console.log('\n Restarting Troxy service...');

557 try {

558 if (osR.platform() === 'linux') {

559 // Migrate service file from old "troxy mcp" to "troxy daemon" if needed

560 const svcPath = '/etc/systemd/system/troxy-mcp.service';

561 if (fsR.existsSync(svcPath)) {

562 const svc = fsR.readFileSync(svcPath, 'utf8');

563 if (svc.includes('ExecStart=') && svc.includes(' mcp') && !svc.includes(' daemon')) {

564 const fixed = svc.replace(/(ExecStart=\S+) mcp/, '$1 daemon');

565 fsR.writeFileSync('/tmp/troxy-mcp.service', fixed);

566 _execSyncRestart('sudo mv /tmp/troxy-mcp.service /etc/systemd/system/troxy-mcp.service');

567 _execSyncRestart('sudo systemctl daemon-reload');

568 process.stdout.write(' Migrated service to daemon mode ✓\n');

569 }

570 }

571 _execSyncRestart('sudo systemctl restart troxy-mcp', { stdio: 'inherit' });

572 } else if (osR.platform() === 'darwin') {

Lines 613-653javascript

613 // moved. For a cloud agent the package is beside the point: what goes stale

614 // is its picture of which checkpoints exist, and that lives on the server.

615 // This is a no-op on a machine with an MCP client, which gets a fresh tool

616 // list from the MCP handshake every session anyway.

617 const { refreshHostedInstructions } = await import('../src/init.js');

618 const refresh = async () => {

619 try {

620 return await refreshHostedInstructions((loadConfig() || {}).apiKey);

621 } catch { return false; }

622 };

623

624 if (current === latest) {

625 console.log(`already up to date (${current})`);

626 if (!await refresh()) console.log('');

627 break;

628 }

629

630 console.log(`${current} → ${latest}`);

631 process.stdout.write(' Installing... ');

632 try {

633 try {

634 execSync('npm install -g troxy-cli@latest', { stdio: 'pipe' });

635 } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/troxy.jsView on unpkg · L633

636 const stderr = err.stderr?.toString() || '';

637 if (stderr.includes('ENOTEMPTY')) {

638 // npm bug on macOS/Homebrew: rename fails because dir has contents.

639 // rm -rf the stale dir directly, then reinstall cleanly.

640 const globalRoot = execSync('npm root -g', { stdio: 'pipe' }).toString().trim();

641 execSync(`rm -rf "${globalRoot}/troxy-cli" && npm install -g troxy-cli@latest`, { stdio: 'pipe', shell: true });

642 } else {

643 throw err;

644 }

645 }

646 // Also refresh the npx cache so MCP servers (e.g. OpenClaw) pick up the new version

647 try { execSync(`npx --yes troxy-cli@${latest} --version`, { stdio: 'pipe' }); } catch { /* non-fatal */ }

648 console.log(`✓\n\n Updated to ${latest}.`);

649

650 // Re-run the exact same client/hook provisioning `troxy init` does,

651 // using the key already saved on this machine - a version bump can

652 // change what gets registered (e.g. 1.21.0 added a PreToolUse hook

653 // alongside the existing Stop hook), and `update` silently leaving