Loading npm security reports…

troxy-cli@1.29.7: Malicious npm security report (Block) | LPM Firewall

registry / troxy-cli / 1.29.7

troxy-cli@1.29.7

A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Explicit setup installs global AI-agent hooks and a persistent daemon. The hooks send assistant reply excerpts to Troxy, and the optional interception route forwards Anthropic credentials through Troxy.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Running `troxy init`; the configured hooks then run on Claude Code turns, and proxy routing activates when enabled.

Impact

Assistant reply content and Anthropic credentials are transmitted to Troxy-controlled services, with configuration and service persistence.

Mechanism

Global hook telemetry and credential-forwarding TLS interception.

Attack narrative

After an operator runs the setup command, the package registers global Claude Code hooks and a background service. On later Claude Code turns, the Stop hook reads transcript reply text and sends an excerpt to the Troxy API. Its enabled proxy route terminates traffic for api.anthropic.com and forwards the original Authorization value to proxy.troxy.io in a separate header. These behaviors create persistent collection and credential-forwarding paths beyond ordinary local CLI operation.

AI rationale

The package has no install-time lifecycle hook, but its explicit setup command creates persistent global agent control points that collect transcript content and forward provider credentials to Troxy endpoints. The concrete data and credential transmission makes this malicious rather than a harmless configuration helper.

Evidence

src/init.jssrc/hook-report.jssrc/interceptor.jssrc/providers.jsAGENTS.md~/.claude/settings.json~/.claude.json

Source & flagged code

9 flagged · loading source

bin/troxy.jsView file

510case 'restart': { L511: const { execSync: _execSyncRestart } = await import('child_process'); L512: const fsR = await import('fs');

High

Child Process

Package source references child process execution.

bin/troxy.jsView on unpkg · L510

539} L540: _execSyncRestart(`launchctl unload ${plistPath} 2>/dev/null; launchctl load ${plistPath}`, { shell: true, stdio: 'inherit' }); L541: } else {

High

Shell

Package source references shell execution.

bin/troxy.jsView on unpkg · L539

554case 'update': { L555: const { execSync } = await import('child_process'); L556: const { createRequire } = await import('module'); ... L559: L560: process.stdout.write('\n Checking for updates... '); L561: let latest; L562: try { L563: const res = await fetch('https://registry.npmjs.org/troxy-cli/latest', { signal: AbortSignal.timeout(5000) }); L564: ({ version: latest } = await res.json());

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/troxy.jsView on unpkg · L554

554Trigger-reachable command-output exfiltration chain: manifest.bin -> bin/troxy.js L554: case 'update': { L555: const { execSync } = await import('child_process'); L556: const { createRequire } = await import('module'); ... L559: L560: process.stdout.write('\n Checking for updates... '); L561: let latest; L562: try { L563: const res = await fetch('https://registry.npmjs.org/troxy-cli/latest', { signal: AbortSignal.timeout(5000) }); L564: ({ version: latest } = await res.json());

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/troxy.jsView on unpkg · L554

69Trigger-reachable persistence chain: manifest.bin -> bin/troxy.js L69: const { createRequire } = await import('module'); L70: const { version } = createRequire(import.meta.url)('../package.json'); L71: process.stdout.write(version); L72: try { L73: const res = await fetch('https://registry.npmjs.org/troxy-cli/latest', { signal: AbortSignal.timeout(3000) }); L74: const { version: latest } = await res.json(); L75: if (version !== latest) { ... L98: } L99: const apiKey = loadConfig()?.apiKey || process.env.TROXY_API_KEY; L100: if (!apiKey) { ... L510: case 'restart': { L511: const { execSync: _execSyncRestart } = await import('child_process');

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/troxy.jsView on unpkg · L69

592try { L593: execSync('npm install -g troxy-cli@latest', { stdio: 'pipe' }); L594: } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/troxy.jsView on unpkg · L592

69const { createRequire } = await import('module'); L70: const { version } = createRequire(import.meta.url)('../package.json'); L71: process.stdout.write(version); L72: try { L73: const res = await fetch('https://registry.npmjs.org/troxy-cli/latest', { signal: AbortSignal.timeout(3000) }); L74: const { version: latest } = await res.json(); L75: if (version !== latest) { ... L98: } L99: const apiKey = loadConfig()?.apiKey || process.env.TROXY_API_KEY; L100: if (!apiKey) { ... L510: case 'restart': { L511: const { execSync: _execSyncRestart } = await import('child_process');

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/troxy.jsView on unpkg · L69

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/init.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = troxy-cli@1.29.6 matchedIdentity = npm:dHJveHktY2xp:1.29.6 similarity = 0.962 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/init.jsView on unpkg

Source & flagged code

9 flagged

bin/troxy.jsView file

Lines 49-89javascript

49 // JWT-based command — session expired or not logged in

50 console.error('\n Session expired or not logged in. Run: troxy login\n');

51 } else if (source === 'config') {

52 console.error('\n API key revoked or invalid.');

53 console.error(' Your saved key is no longer accepted by Troxy.');

54 console.error(' Run: npx troxy-cli init --key <new-key> to reconnect.\n');

55 } else {

56 console.error('\n API key invalid or revoked.');

57 console.error(' Check the key in your Troxy dashboard → API Keys.\n');

58 }

59 } else {

60 console.error(`\n Error: ${err.message}\n`);

61 }

62 process.exit(1);

63}

64

65async function _run() {

66switch (command) {

67 case '--version':

68 case '-v': {

69 const { createRequire } = await import('module');

70 const { version } = createRequire(import.meta.url)('../package.json');

71 process.stdout.write(version);

72 try {

73 const res = await fetch('https://registry.npmjs.org/troxy-cli/latest', { signal: AbortSignal.timeout(3000) });

74 const { version: latest } = await res.json();

75 if (version !== latest) {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/troxy.jsView on unpkg · L69

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/troxy.jsView on unpkg · L69

76 process.stdout.write(` ⚠ ${latest} available, run: troxy update`);

77 }

78 } catch {}

79 process.stdout.write('\n');

80 break;

81 }

82

83 // ── Setup ─────────────────────────────────────────────────────

84 case 'init':

85 await runInit(flags);

86 break;

87

88 case 'tools': {

89 if (flags.help || flags.h) {

Lines 490-612javascript

490 console.log();

491 }

492

493 // Version check

494 try {

495 const { createRequire } = await import('module');

496 const

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/init.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = troxy-cli@1.29.6 matchedIdentity = npm:dHJveHktY2xp:1.29.6 similarity = 0.962 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/init.jsView on unpkg