Loading npm security reports…

troxy-cli@1.29.38: Suspicious npm security report (Warn) | LPM Firewall

registry / troxy-cli / 1.29.38

troxy-cli@1.29.38

A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI

AI Security Review

scanned 22h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The explicit initialization command installs Troxy’s Claude Code skill, which can affect model routing during later sessions. This is a package-owned agent extension capability; no confirmed malicious attack surface was established.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user runs `troxy init` on a machine with a supported Claude Code installation.

Impact

Later Claude Code sessions may use Troxy’s routing behavior and incur model requests through the configured Claude Code session.

Mechanism

Initialization removes the existing Troxy skill directory and copies the package’s skill files into it. The skill scores prompts and may select a different model for the turn.

AI rationale

The npm install hook only checks the Node version, while the agent extension is installed by the explicit `troxy init` command. The package-owned skill changes later agent routing, warranting a warning under the agent extension policy, but the inspected source does not establish malicious behavior.

Evidence

src/init.jssrc/mods/troxy-guard/hooks/register.jssrc/tests/init-mods.test.js

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/check-node.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/troxy.jsView file

606case 'restart': { L607: const { execSync: _execSyncRestart } = await import('child_process'); L608: const fsR = await import('fs');

High

Child Process

Package source references child process execution.

bin/troxy.jsView on unpkg · L606

69Trigger-reachable persistence chain: manifest.bin -> bin/troxy.js L69: const { createRequire } = await import('module'); L70: const { version } = createRequire(import.meta.url)('../package.json'); L71: process.stdout.write(version); L72: try { ... L97: } L98: const apiKey = loadConfig()?.apiKey || process.env.TROXY_API_KEY; L99: if (!apiKey) { ... L108: await runToolDetection(apiKey); L109: console.log(' Saved ✓ See it at https://dash.troxy.io\n'); L110: break; ... L138: } = await import('../src/init.js'); L139: const dir = process.cwd();

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/troxy.jsView on unpkg · L69

687try { L688: execSync('npm install -g troxy-cli@latest', { stdio: 'pipe' }); L689: } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/troxy.jsView on unpkg · L687

69const { createRequire } = await import('module'); L70: const { version } = createRequire(import.meta.url)('../package.json'); L71: process.stdout.write(version); L72: try { ... L97: } L98: const apiKey = loadConfig()?.apiKey || process.env.TROXY_API_KEY; L99: if (!apiKey) { ... L108: await runToolDetection(apiKey); L109: console.log(' Saved ✓ See it at https://dash.troxy.io\n'); L110: break; ... L138: } = await import('../src/init.js'); L139: const dir = process.cwd();

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/troxy.jsView on unpkg · L69

src/mcp-server.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/mcp-server.js#virtual:normalized:round1View on unpkg

src/auth.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/auth.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/auth.jsView on unpkg

src/tool_detect.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/tool_detect.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tool_detect.jsView on unpkg

src/mods/troxy-guard/hooks/register.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = troxy-cli@1.29.37 matchedIdentity = npm:dHJveHktY2xp:1.29.37 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/mods/troxy-guard/hooks/register.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "troxy-cli",

3 "version": "1.29.38",

4 "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",

5 "homepage": "https://troxy.io",

6 "bugs": {

7 "email": "support@troxy.io"

8 },

9 "type": "module",

10 "bin": {

11 "troxy": "bin/troxy.js"

12 },

13 "scripts": {

14 "preinstall": "node scripts/check-node.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

15 "test": "node --test src/tests/*.test.js"

16 },

17 "dependencies": {

18 "@modelcontextprotocol/sdk": "^1.30.0",

19 "node-forge": "^1.4.0"

20 },

21 "overrides": {

22 "fast-uri": "^3.1.6",

23 "ip-address": "^10.3.1",

24 "hono": "^4.13.8",

25 "qs": "^6.16.0",

26 "body-parser": "^2.3.0",

27 "@hono/node-server": "^1.19.17"

28 },

29 "engines": {

30 "node": ">=18"

31 },

32 "files": [

33 "bin/",

34 "src/",

bin/troxy.jsView file

Lines 49-89javascript

49 // JWT-based command — session expired or not logged in

50 console.error('\n Session expired or not logged in. Run: troxy login\n');

51 } else if (source === 'config') {

52 console.error('

src/mcp-server.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/mcp-server.js#virtual:normalized:round1View on unpkg

src/auth.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/auth.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/auth.jsView on unpkg

src/tool_detect.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/tool_detect.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tool_detect.jsView on unpkg

src/mods/troxy-guard/hooks/register.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = troxy-cli@1.29.37 matchedIdentity = npm:dHJveHktY2xp:1.29.37 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/mods/troxy-guard/hooks/register.jsView on unpkg

Lines 586-626javascript

586 } else {

587 console.log(' Account: not signed in. Run `troxy login` to manage policies and view activity from the CLI.\n');

588 }

589

590 // Version check

591 try {

592 const { createRequire } = await import('module');

593 const require = createRequire(import.meta.url);

594 const { version: current } = require('../package.json');

595 const latest = await checkLatestVersion();

596 if (current !== latest) {

597 console.log(` ⚠ New version available: ${latest} (you have ${current})`);

598 console.log(` Run: troxy update\n`);

599 }

600 } catch {}

601

602 break;

603 }

604

605 // ── Restart MCP service ───────────────────────────────────────

606 case 'restart': {

607 const { execSync: _execSyncRestart } = await import('child_process');

608 const fsR = await import('fs');

High

Child Process

Package source references child process execution.

bin/troxy.jsView on unpkg · L606

609 const osR = (await import('os')).default;

610 console.log('\n Restarting Troxy service...');

611 try {

612 if (osR.platform() === 'linux') {

613 // Migrate service file from old "troxy mcp" to "troxy daemon" if needed

614 const svcPath = '/etc/systemd/system/troxy-mcp.service';

615 if (fsR.existsSync(svcPath)) {

616 const svc = fsR.readFileSync(svcPath, 'utf8');

617 if (svc.includes('ExecStart=') && svc.includes(' mcp') && !svc.includes(' daemon')) {

618 const fixed = svc.replace(/(ExecStart=\S+) mcp/, '$1 daemon');

619 fsR.writeFileSync('/tmp/troxy-mcp.service', fixed);

620 _execSyncRestart('sudo mv /tmp/troxy-mcp.service /etc/systemd/system/troxy-mcp.service');

621 _execSyncRestart('sudo systemctl daemon-reload');

622 process.stdout.write(' Migrated service to daemon mode ✓\n');

623 }

624 }

625 _execSyncRestart('sudo systemctl restart troxy-mcp', { stdio: 'inherit' });

626 } else if (osR.platform() === 'darwin') {

Lines 667-707javascript

667 // moved. For a cloud agent the package is beside the point: what goes stale

668 // is its picture of which checkpoints exist, and that lives on the server.

669 // This is a no-op on a machine with an MCP client, which gets a fresh tool

670 // list from the MCP handshake every session anyway.

671 const { refreshHostedInstructions } = await import('../src/init.js');

672 const refresh = async () => {

673 try {

674 return await refreshHostedInstructions((loadConfig() || {}).apiKey);

675 } catch { return false; }

676 };

677

678 if (current === latest) {

679 console.log(`already up to date (${current})`);

680 if (!await refresh()) console.log('');

681 break;

682 }

683

684 console.log(`${current} → ${latest}`);

685 process.stdout.write(' Installing... ');

686 try {

687 try {

688 execSync('npm install -g troxy-cli@latest', { stdio: 'pipe' });

689 } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/troxy.jsView on unpkg · L687

690 const stderr = err.stderr?.toString() || '';

691 if (stderr.includes('ENOTEMPTY')) {

692 // npm bug on macOS/Homebrew: rename fails because dir has contents.

693 // rm -rf the stale dir directly, then reinstall cleanly.

694 const globalRoot = execSync('npm root -g', { stdio: 'pipe' }).toString().trim();

695 execSync(`rm -rf "${globalRoot}/troxy-cli" && npm install -g troxy-cli@latest`, { stdio: 'pipe', shell: true });

696 } else {

697 throw err;

698 }

699 }

700 // Also refresh the npx cache so MCP servers (e.g. OpenClaw) pick up the new version

701 try { execSync(`npx --yes troxy-cli@${latest} --version`, { stdio: 'pipe' }); } catch { /* non-fatal */ }

702 console.log(`✓\n\n Updated to ${latest}.`);

703

704 // Re-run the exact same client/hook provisioning `troxy init` does,

705 // using the key already saved on this machine - a version bump can

706 // change what gets registered (e.g. 1.21.0 added a PreToolUse hook

707 // alongside the existing Stop hook), and `update` silently leaving