troxy-cli@1.29.25: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

troxy-cli@1.29.25: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/check-node.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/troxy.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = troxy-cli@1.29.10 matchedIdentity = npm:dHJveHktY2xp:1.29.10 similarity = 0.707 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/troxy.jsView on unpkg

599case 'restart': { L600: const { execSync: _execSyncRestart } = await import('child_process'); L601: const fsR = await import('fs');

High

Child Process

Package source references child process execution.

bin/troxy.jsView on unpkg · L599

69Trigger-reachable persistence chain: manifest.bin -> bin/troxy.js L69: const { createRequire } = await import('module'); L70: const { version } = createRequire(import.meta.url)('../package.json'); L71: process.stdout.write(version); L72: try { ... L97: } L98: const apiKey = loadConfig()?.apiKey || process.env.TROXY_API_KEY; L99: if (!apiKey) { ... L108: await runToolDetection(apiKey); L109: console.log(' Saved ✓ See it at https://dash.troxy.io\n'); L110: break; ... L138: } = await import('../src/init.js'); L139: const dir = process.cwd();

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/troxy.jsView on unpkg · L69

680try { L681: execSync('npm install -g troxy-cli@latest', { stdio: 'pipe' }); L682: } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/troxy.jsView on unpkg · L680

69const { createRequire } = await import('module'); L70: const { version } = createRequire(import.meta.url)('../package.json'); L71: process.stdout.write(version); L72: try { ... L97: } L98: const apiKey = loadConfig()?.apiKey || process.env.TROXY_API_KEY; L99: if (!apiKey) { ... L108: await runToolDetection(apiKey); L109: console.log(' Saved ✓ See it at https://dash.troxy.io\n'); L110: break; ... L138: } = await import('../src/init.js'); L139: const dir = process.cwd();

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/troxy.jsView on unpkg · L69

src/mcp-server.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/mcp-server.js#virtual:normalized:round1View on unpkg

src/auth.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/auth.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/auth.jsView on unpkg

src/tool_detect.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/tool_detect.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tool_detect.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "troxy-cli",

3 "version": "1.29.25",

4 "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",

5 "homepage": "https://troxy.io",

6 "bugs": {

7 "email": "support@troxy.io"

8 },

9 "type": "module",

10 "bin": {

11 "troxy": "bin/troxy.js"

12 },

13 "scripts": {

14 "preinstall": "node scripts/check-node.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

15 "test": "node --test src/tests/*.test.js"

16 },

17 "dependencies": {

18 "@modelcontextprotocol/sdk": "^1.30.0",

19 "node-forge": "^1.4.0"

20 },

21 "overrides": {

22 "fast-uri": "^3.1.6",

23 "ip-address": "^10.3.1",

24 "hono": "^4.13.8",

25 "qs": "^6.16.0",

26 "body-parser": "^2.3.0",

27 "@hono/node-server": "^1.19.17"

28 },

29 "engines": {

30 "node": ">=18"

31 },

32 "files": [

33 "bin/",

34 "src/",

bin/troxy.jsView file

Lines 49-89javascript

49 // JWT-based command — session expired or not logged in

50 console.error('\n Session expired or not logged in. Run: troxy login\n');

51 } else if (source === 'config') {

52 console.error('

src/mcp-server.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/mcp-server.js#virtual:normalized:round1View on unpkg

src/auth.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/auth.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/auth.jsView on unpkg

src/tool_detect.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/tool_detect.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tool_detect.jsView on unpkg

Lines 579-619javascript

579 } else {

580 console.log(' Account: not signed in. Run `troxy login` to manage policies and view activity from the CLI.\n');

581 }

582

583 // Version check

584 try {

585 const { createRequire } = await import('module');

586 const require = createRequire(import.meta.url);

587 const { version: current } = require('../package.json');

588 const latest = await checkLatestVersion();

589 if (current !== latest) {

590 console.log(` ⚠ New version available: ${latest} (you have ${current})`);

591 console.log(` Run: troxy update\n`);

592 }

593 } catch {}

594

595 break;

596 }

597

598 // ── Restart MCP service ───────────────────────────────────────

599 case 'restart': {

600 const { execSync: _execSyncRestart } = await import('child_process');

601 const fsR = await import('fs');

High

Child Process

Package source references child process execution.

bin/troxy.jsView on unpkg · L599

602 const osR = (await import('os')).default;

603 console.log('\n Restarting Troxy service...');

604 try {

605 if (osR.platform() === 'linux') {

606 // Migrate service file from old "troxy mcp" to "troxy daemon" if needed

607 const svcPath = '/etc/systemd/system/troxy-mcp.service';

608 if (fsR.existsSync(svcPath)) {

609 const svc = fsR.readFileSync(svcPath, 'utf8');

610 if (svc.includes('ExecStart=') && svc.includes(' mcp') && !svc.includes(' daemon')) {

611 const fixed = svc.replace(/(ExecStart=\S+) mcp/, '$1 daemon');

612 fsR.writeFileSync('/tmp/troxy-mcp.service', fixed);

613 _execSyncRestart('sudo mv /tmp/troxy-mcp.service /etc/systemd/system/troxy-mcp.service');

614 _execSyncRestart('sudo systemctl daemon-reload');

615 process.stdout.write(' Migrated service to daemon mode ✓\n');

616 }

617 }

618 _execSyncRestart('sudo systemctl restart troxy-mcp', { stdio: 'inherit' });

619 } else if (osR.platform() === 'darwin') {

Lines 660-700javascript

660 // moved. For a cloud agent the package is beside the point: what goes stale

661 // is its picture of which checkpoints exist, and that lives on the server.

662 // This is a no-op on a machine with an MCP client, which gets a fresh tool

663 // list from the MCP handshake every session anyway.

664 const { refreshHostedInstructions } = await import('../src/init.js');

665 const refresh = async () => {

666 try {

667 return await refreshHostedInstructions((loadConfig() || {}).apiKey);

668 } catch { return false; }

669 };

670

671 if (current === latest) {

672 console.log(`already up to date (${current})`);

673 if (!await refresh()) console.log('');

674 break;

675 }

676

677 console.log(`${current} → ${latest}`);

678 process.stdout.write(' Installing... ');

679 try {

680 try {

681 execSync('npm install -g troxy-cli@latest', { stdio: 'pipe' });

682 } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/troxy.jsView on unpkg · L680

683 const stderr = err.stderr?.toString() || '';

684 if (stderr.includes('ENOTEMPTY')) {

685 // npm bug on macOS/Homebrew: rename fails because dir has contents.

686 // rm -rf the stale dir directly, then reinstall cleanly.

687 const globalRoot = execSync('npm root -g', { stdio: 'pipe' }).toString().trim();

688 execSync(`rm -rf "${globalRoot}/troxy-cli" && npm install -g troxy-cli@latest`, { stdio: 'pipe', shell: true });

689 } else {

690 throw err;

691 }

692 }

693 // Also refresh the npx cache so MCP servers (e.g. OpenClaw) pick up the new version

694 try { execSync(`npx --yes troxy-cli@${latest} --version`, { stdio: 'pipe' }); } catch { /* non-fatal */ }

695 console.log(`✓\n\n Updated to ${latest}.`);

696

697 // Re-run the exact same client/hook provisioning `troxy init` does,

698 // using the key already saved on this machine - a version bump can

699 // change what gets registered (e.g. 1.21.0 added a PreToolUse hook

700 // alongside the existing Stop hook), and `update` silently leaving