cli@3.63.0

CAUTION

Publisher claims: "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher claude-flow · joined 0 days agoInstalls 284KLast detonated 1 h ago

Dispute verdict

Behavior trace

Honeypot run · 4 s · 2 scenarios · 0 deviations

t+CategoryObserved action

3.1sprocessdependency install exit 1

3.4sprocessexec /usr/bin/timeout

3.4sprocessexited 1: Node.js v22.23.4

3.4sclaimedno tools/list reply (exit 1)

3.4sprocessscript backend runs setup only

Static findings

CRITICAL

Access to sensitive file pathsdist/src/commands/init.js:312 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Pipe-to-shell patternREADME.md:313 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

CRITICAL

Access to sensitive file pathsdist/src/commands/init.js:106 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/commands/index.js:132 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/commands/hooks.js:3638 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/commands/mcp.js:39 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/auth/client.js:31 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Pipe-to-shell patternREADME.md:297 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

CRITICAL

Access to sensitive file pathsbin/cli.js:45 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/commands/mcp.js:147 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/commands/eject.js:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/index.js:548 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/init/executor.js:301 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/commands/mcp.js:424 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/index.js:112 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/init/executor.js:300 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/init/types.js:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/init/types.js:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/funnel/state.js:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/init/executor.js:734 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/funnel/promo.js:70 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/commands/tui.js:60 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/commands/mcp.js:525 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/init/executor.js:743 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/commands/tui.js:119 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/index.js:570 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/mcp-server.js:169 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/mods/apply.js:73 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/mods/install.js:70 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/mcp-client.js:287 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/mods/apply.js:117 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/init/types.js:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/init/types.js:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/mods/install.js:59 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/mcp-server.js:138 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/mcp-server.js:125 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/mods/apply.js:116 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/mods/apply.js:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/mods/install.js:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/mcp-server.js:448 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/mcp-server.js:287 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageREADME.md:44 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:80 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Credential pass-through configurationdist/src/proxy/paths.d.ts:16 · Credential pass-through configuration — agent relays sensitive credentials

AST02

HIGH

npx invocation of non-well-known packagebin/cli.js:123 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagebin/cli.js:146 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsdist/src/mods/install.js:74 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageREADME.md:50 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsdist/src/proxy/release.js:122 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageREADME.md:41 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsdist/src/proxy/release.js:133 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/src/mods/probe.js:118 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Credential pass-through configurationdist/src/proxy/paths.js:33 · Credential pass-through configuration — agent relays sensitive credentials

AST02

HIGH

npx invocation of non-well-known packagebin/cli.js:90 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:55 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagebin/cli.js:8 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Process kill commanddist/src/commands/mcp.js:127 · Process kill command — agent can terminate processes

AST05

HIGH

npx invocation of non-well-known packagedist/src/commands/hooks.js:2843 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/eject.js:97 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/eject.js:9 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/init.js:162 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/eject.js:10 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/init.js:90 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Process kill commanddist/src/commands/mcp.js:224 · Process kill command — agent can terminate processes

AST05

HIGH

npx invocation of non-well-known packagedist/src/commands/init.js:164 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/hooks.js:3032 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/init.js:183 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Process kill commanddist/src/commands/mcp.js:140 · Process kill command — agent can terminate processes

AST05

HIGH

npx invocation of non-well-known packagedist/src/commands/hooks.js:2842 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/init.js:202 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/hooks.js:2841 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/eject.js:11 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/hooks.js:2844 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/eject.js:95 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Auto-update or dynamic fetch configurationdist/src/index.js:514 · Auto-update or dynamic fetch configuration — agent may load new code at runtime

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/tui.js:12 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Auto-update or dynamic fetch configurationdist/src/index.js:506 · Auto-update or dynamic fetch configuration — agent may load new code at runtime

AST06

HIGH

File permission modification commanddist/src/fs-secure.js:10 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

npx invocation of non-well-known packagedist/src/commands/swarm.js:683 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/swarm.js:732 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/swarm.js:731 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/mcp.js:276 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/tui.js:11 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/tui.js:13 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

File permission modification commanddist/src/fs-secure.d.ts:10 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

npx invocation of non-well-known packagedist/src/commands/swarm.js:681 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/tui.js:14 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/tui.js:15 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Instructs the agent to modify its persistent memory or instruction filesdist/src/init/executor.js:2042 · Instructs the agent to modify its persistent memory or instruction files

AST01

HIGH

npx invocation of non-well-known packagedist/src/init/executor.js:365 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Instructs the agent to modify its persistent memory or instruction filesdist/src/init/executor.js:2068 · Instructs the agent to modify its persistent memory or instruction files

AST01

HIGH

Auto-update or dynamic fetch configurationdist/src/update/index.js:38 · Auto-update or dynamic fetch configuration — agent may load new code at runtime

AST06

HIGH

Process kill commanddist/src/mcp-server.js:1136 · Process kill command — agent can terminate processes

AST05

HIGH

Process kill commanddist/src/mcp-server.d.ts:234 · Process kill command — agent can terminate processes

AST05

HIGH

npx invocation of non-well-known packagedist/src/init/executor.js:375 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/log-filters.js:70 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Auto-update or dynamic fetch configurationdist/src/update/index.js:20 · Auto-update or dynamic fetch configuration — agent may load new code at runtime

AST06

HIGH

Process kill commanddist/src/mcp-server.js:1131 · Process kill command — agent can terminate processes

AST05

HIGH

Process kill commanddist/src/mcp-server.js:381 · Process kill command — agent can terminate processes

AST05

HIGH

Process kill commanddist/src/mcp-server.d.ts:215 · Process kill command — agent can terminate processes

AST05

HIGH

npx invocation of non-well-known packagedist/src/init/executor.js:374 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/init/executor.js:398 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Process kill commanddist/src/mcp-server.js:1036 · Process kill command — agent can terminate processes

AST05

HIGH

npx invocation of non-well-known packagedist/src/init/executor.js:205 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Process kill commanddist/src/mcp-server.js:1099 · Process kill command — agent can terminate processes

AST05

LOW

Unpinned dependencyREADME.md:310 · Unpinned dependency

AST06

MEDIUM

MCP server using network transport (SSE/HTTP)dist/src/commands/mcp.js:11 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

MEDIUM

File type combined with upload actiondist/src/commands/hooks.js:3258 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

Remote installer piped to shellREADME.md:313 · Remote installer piped to shell

AST07

MEDIUM

Remote installer piped to shellREADME.md:297 · Remote installer piped to shell

AST07

MEDIUM

File type combined with upload actiondist/src/commands/hooks.js:3038 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actiondist/src/commands/hooks.js:2847 · File type combined with upload action — agent may exfiltrate local data files

AST07