troxy-cli@1.29.9: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

troxy-cli@1.29.9: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

12 flagged · loading source

bin/troxy.jsView file

510case 'restart': { L511: const { execSync: _execSyncRestart } = await import('child_process'); L512: const fsR = await import('fs');

High

Child Process

Package source references child process execution.

bin/troxy.jsView on unpkg · L510

539} L540: _execSyncRestart(`launchctl unload ${plistPath} 2>/dev/null; launchctl load ${plistPath}`, { shell: true, stdio: 'inherit' }); L541: } else {

High

Shell

Package source references shell execution.

bin/troxy.jsView on unpkg · L539

554case 'update': { L555: const { execSync } = await import('child_process'); L556: const { createRequire } = await import('module'); ... L559: L560: process.stdout.write('\n Checking for updates... '); L561: let latest; L562: try { L563: const res = await fetch('https://registry.npmjs.org/troxy-cli/latest', { signal: AbortSignal.timeout(5000) }); L564: ({ version: latest } = await res.json());

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/troxy.jsView on unpkg · L554

554Trigger-reachable command-output exfiltration chain: manifest.bin -> bin/troxy.js L554: case 'update': { L555: const { execSync } = await import('child_process'); L556: const { createRequire } = await import('module'); ... L559: L560: process.stdout.write('\n Checking for updates... '); L561: let latest; L562: try { L563: const res = await fetch('https://registry.npmjs.org/troxy-cli/latest', { signal: AbortSignal.timeout(5000) }); L564: ({ version: latest } = await res.json());

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/troxy.jsView on unpkg · L554

69Trigger-reachable persistence chain: manifest.bin -> bin/troxy.js L69: const { createRequire } = await import('module'); L70: const { version } = createRequire(import.meta.url)('../package.json'); L71: process.stdout.write(version); L72: try { L73: const res = await fetch('https://registry.npmjs.org/troxy-cli/latest', { signal: AbortSignal.timeout(3000) }); L74: const { version: latest } = await res.json(); L75: if (version !== latest) { ... L98: } L99: const apiKey = loadConfig()?.apiKey || process.env.TROXY_API_KEY; L100: if (!apiKey) { ... L510: case 'restart': { L511: const { execSync: _execSyncRestart } = await import('child_process');

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/troxy.jsView on unpkg · L69

592try { L593: execSync('npm install -g troxy-cli@latest', { stdio: 'pipe' }); L594: } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/troxy.jsView on unpkg · L592

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = bin/troxy.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/troxy.jsView on unpkg

69const { createRequire } = await import('module'); L70: const { version } = createRequire(import.meta.url)('../package.json'); L71: process.stdout.write(version); L72: try { L73: const res = await fetch('https://registry.npmjs.org/troxy-cli/latest', { signal: AbortSignal.timeout(3000) }); L74: const { version: latest } = await res.json(); L75: if (version !== latest) { ... L98: } L99: const apiKey = loadConfig()?.apiKey || process.env.TROXY_API_KEY; L100: if (!apiKey) { ... L510: case 'restart': { L511: const { execSync: _execSyncRestart } = await import('child_process');

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/troxy.jsView on unpkg · L69

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/auth.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/auth.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/auth.jsView on unpkg

src/uninstall.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/uninstall.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/uninstall.jsView on unpkg

src/tool_detect.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/tool_detect.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tool_detect.jsView on unpkg

Source & flagged code

12 flagged

bin/troxy.jsView file

Lines 49-89javascript

49 // JWT-based command — session expired or not logged in

50 console.error('\n Session expired or not logged in. Run: troxy login\n');

51 } else if (source === 'config') {

52 console.error('\n API key revoked or invalid.');

53 console.error(' Your saved key is no longer accepted by Troxy.');

54 console.error(' Run: npx troxy-cli init --key <new-key> to reconnect.\n');

55 } else {

56 console.error('\n API key invalid or revoked.');

57 console.error(' Check the key in your Troxy dashboard → API Keys.\n');

58 }

59 } else {

60 console.error(`\n Error: ${err.message}\n`);

61 }

62 process.exit(1);

63}

64

65async function _run() {

66switch (command) {

67 case '--version':

68 case '-v': {

69 const { createRequire } = await import('module');

70 const { version } = createRequire(import.meta.url)('../package.json');

71 process.stdout.write(version);

72 try {

73 const res = await fetch('https://registry.npmjs.org/troxy-cli/latest', { signal: AbortSignal.timeout(3000) });

74 const { version: latest } = await res.json();

75 if (version !== latest) {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/troxy.jsView on unpkg · L69

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/troxy.jsView on unpkg · L69

76 process.stdout.write(` ⚠ ${latest} available, run: troxy update`);

77 }

78 } catch {}

79 process.stdout.write('\n');

80 break;

81 }

82

83 // ── Setup ─────────────────────────────────────────────────────

84 case 'init':

85 await runInit(flags);

86 break;

87

88 case 'tools': {

89 if (flags.help || flags.h) {

Lines 490-612javascript

490 console.log();

491 }

492

493 // Version check

494 try {

495 const { createRequire } = await import('module');

496 const

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = bin/troxy.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/troxy.jsView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/auth.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/auth.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/auth.jsView on unpkg

src/uninstall.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/uninstall.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/uninstall.jsView on unpkg

src/tool_detect.jsView file

•matchType = normalized_sha256 matchedPackage = troxy-cli@1.29.7 matchedPath = src/tool_detect.js matchedIdentity = npm:dHJveHktY2xp:1.29.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tool_detect.jsView on unpkg