Loading npm security reports…

troxy-cli@1.29.37: Suspicious npm security report (Warn) | LPM Firewall

registry / troxy-cli / 1.29.37

troxy-cli@1.29.37

A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI

AI Security Review

scanned 23h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user runs `troxy init` with a valid Troxy key.

Impact

Claude Code configuration and available agent extensions are changed; the installed hook and skill can affect later Claude Code sessions.

Mechanism

Init provisions Claude Code settings and hooks, copies a Troxy Guard skill into the user’s Claude skills directory, and adds a usage-bar notification hook.

AI rationale

The npm lifecycle hook only checks the Node version, while the agent configuration changes occur during explicit CLI initialization. Automatic first-party agent extension setup merits a warning, but inspected source does not establish a malicious attack.

Evidence

src/init.jssrc/install-mod.jspackage.json

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Running `troxy init` provisions Claude Code settings and installs Troxy-owned agent extensions without a separate extension consent step.

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/check-node.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/troxy.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = troxy-cli@1.29.10 matchedIdentity = npm:dHJveHktY2xp:1.29.10 similarity = 0.707 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/troxy.jsView on unpkg

606case 'restart': { L607: const { execSync: _execSyncRestart } = await import('child_process'); L608: const fsR = await import('fs');

High

Child Process

Package source references child process execution.

bin/troxy.jsView on unpkg · L606

69Trigger-reachable persistence chain: manifest.bin -> bin/troxy.js L69: const { createRequire } = await import('module'); L70: const { version } = createRequire(import.meta.url)('../package.json'); L71: process.stdout.write(version); L72: try { ... L97: } L98: const apiKey = loadConfig()?.apiKey || process.env.TROXY_API_KEY; L99: if (!apiKey) { ... L108: await runToolDetection(apiKey); L109: console.log(' Saved ✓ See it at https://dash.troxy.io\n'); L110: break; ... L138: } = await import('../src/init.js'); L139: const dir = process.cwd();

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/troxy.jsView on unpkg · L69

687try { L688: execSync('npm install -g troxy-cli@latest', { stdio: 'pipe' }); L689: } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/troxy.jsView on unpkg · L687

69const { createRequire } = await import('module'); L70: const { version } = createRequire(import.meta.url)('../package.json'); L71: process.stdout.write(version); L72: try { ... L97: } L98: const apiKey = loadConfig()?.apiKey || process.env.TROXY_API_KEY; L99: if (!apiKey) { ... L108: await runToolDetection(apiKey); L109: console.log(' Saved ✓ See it at https://dash.troxy.io\n'); L110: break; ... L138: } = await import('../src/init.js'); L139: const dir = process.cwd();

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/troxy.jsView on unpkg · L69

src/mcp-server.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/mcp-server.js#virtual:normalized:round1View on unpkg

src/auth.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/auth.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/auth.jsView on unpkg

src/tool_detect.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/tool_detect.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tool_detect.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "troxy-cli",

3 "version": "1.29.37",

4 "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",

5 "homepage": "https://troxy.io",

6 "bugs": {

7 "email": "support@troxy.io"

8 },

9 "type": "module",

10 "bin": {

11 "troxy": "bin/troxy.js"

12 },

13 "scripts": {

14 "preinstall": "node scripts/check-node.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

15 "test": "node --test src/tests/*.test.js"

16 },

17 "dependencies": {

18 "@modelcontextprotocol/sdk": "^1.30.0",

19 "node-forge": "^1.4.0"

20 },

21 "overrides": {

22 "fast-uri": "^3.1.6",

23 "ip-address": "^10.3.1",

24 "hono": "^4.13.8",

25 "qs": "^6.16.0",

26 "body-parser": "^2.3.0",

27 "@hono/node-server": "^1.19.17"

28 },

29 "engines": {

30 "node": ">=18"

31 },

32 "files": [

33 "bin/",

34 "src/",

bin/troxy.jsView file

Lines 49-89javascript

49 // JWT-based command — session expired or not logged in

50 console.error('\n Session expired or not logged in. Run: troxy login\n');

51 } else if (source === 'config') {

52 console.error('

src/mcp-server.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/mcp-server.js#virtual:normalized:round1View on unpkg

src/auth.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/auth.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/auth.jsView on unpkg

src/tool_detect.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/tool_detect.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tool_detect.jsView on unpkg

Lines 586-626javascript

586 } else {

587 console.log(' Account: not signed in. Run `troxy login` to manage policies and view activity from the CLI.\n');

588 }

589

590 // Version check

591 try {

592 const { createRequire } = await import('module');

593 const require = createRequire(import.meta.url);

594 const { version: current } = require('../package.json');

595 const latest = await checkLatestVersion();

596 if (current !== latest) {

597 console.log(` ⚠ New version available: ${latest} (you have ${current})`);

598 console.log(` Run: troxy update\n`);

599 }

600 } catch {}

601

602 break;

603 }

604

605 // ── Restart MCP service ───────────────────────────────────────

606 case 'restart': {

607 const { execSync: _execSyncRestart } = await import('child_process');

608 const fsR = await import('fs');

High

Child Process

Package source references child process execution.

bin/troxy.jsView on unpkg · L606

609 const osR = (await import('os')).default;

610 console.log('\n Restarting Troxy service...');

611 try {

612 if (osR.platform() === 'linux') {

613 // Migrate service file from old "troxy mcp" to "troxy daemon" if needed

614 const svcPath = '/etc/systemd/system/troxy-mcp.service';

615 if (fsR.existsSync(svcPath)) {

616 const svc = fsR.readFileSync(svcPath, 'utf8');

617 if (svc.includes('ExecStart=') && svc.includes(' mcp') && !svc.includes(' daemon')) {

618 const fixed = svc.replace(/(ExecStart=\S+) mcp/, '$1 daemon');

619 fsR.writeFileSync('/tmp/troxy-mcp.service', fixed);

620 _execSyncRestart('sudo mv /tmp/troxy-mcp.service /etc/systemd/system/troxy-mcp.service');

621 _execSyncRestart('sudo systemctl daemon-reload');

622 process.stdout.write(' Migrated service to daemon mode ✓\n');

623 }

624 }

625 _execSyncRestart('sudo systemctl restart troxy-mcp', { stdio: 'inherit' });

626 } else if (osR.platform() === 'darwin') {

Lines 667-707javascript

667 // moved. For a cloud agent the package is beside the point: what goes stale

668 // is its picture of which checkpoints exist, and that lives on the server.

669 // This is a no-op on a machine with an MCP client, which gets a fresh tool

670 // list from the MCP handshake every session anyway.

671 const { refreshHostedInstructions } = await import('../src/init.js');

672 const refresh = async () => {

673 try {

674 return await refreshHostedInstructions((loadConfig() || {}).apiKey);

675 } catch { return false; }

676 };

677

678 if (current === latest) {

679 console.log(`already up to date (${current})`);

680 if (!await refresh()) console.log('');

681 break;

682 }

683

684 console.log(`${current} → ${latest}`);

685 process.stdout.write(' Installing... ');

686 try {

687 try {

688 execSync('npm install -g troxy-cli@latest', { stdio: 'pipe' });

689 } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/troxy.jsView on unpkg · L687

690 const stderr = err.stderr?.toString() || '';

691 if (stderr.includes('ENOTEMPTY')) {

692 // npm bug on macOS/Homebrew: rename fails because dir has contents.

693 // rm -rf the stale dir directly, then reinstall cleanly.

694 const globalRoot = execSync('npm root -g', { stdio: 'pipe' }).toString().trim();

695 execSync(`rm -rf "${globalRoot}/troxy-cli" && npm install -g troxy-cli@latest`, { stdio: 'pipe', shell: true });

696 } else {

697 throw err;

698 }

699 }

700 // Also refresh the npx cache so MCP servers (e.g. OpenClaw) pick up the new version

701 try { execSync(`npx --yes troxy-cli@${latest} --version`, { stdio: 'pipe' }); } catch { /* non-fatal */ }

702 console.log(`✓\n\n Updated to ${latest}.`);

703

704 // Re-run the exact same client/hook provisioning `troxy init` does,

705 // using the key already saved on this machine - a version bump can

706 // change what gets registered (e.g. 1.21.0 added a PreToolUse hook

707 // alongside the existing Stop hook), and `update` silently leaving