Loading npm security reports…

@flotic/minitok@1.4.12: AI-agent control-surface risk | LPM Firewall

registry / @flotic/minitok / 1.4.12

@flotic/minitok@1.4.12

Verified coding workflows for the terminal

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An install-time hook changes Cline's MCP configuration and installs Cline guidance. No affirmative response is required because a blank answer proceeds.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Installing the package in an interactive terminal and submitting an empty response to the setup prompt.

Impact

A package installation can alter a foreign AI-agent control surface and influence later Cline repository-task behavior without explicit opt-in.

Mechanism

The post-install hook generates a token, registers a Node MCP entry in Cline configuration, and writes rules and a skill that steer agent behavior.

Policy narrative

The package automatically runs a post-install script. In an interactive terminal, its confirmation prompt defaults to proceeding when the user presses Enter. It then generates a token, adds an enabled minitok MCP server to Cline configuration, and writes Cline rules and a skill instructing repository tasks to use minitok rather than direct editor or shell tools. This is an unconsented install-time modification of a foreign AI-agent control surface.

AI rationale

The automatic lifecycle hook performs an enabled Cline MCP and behavior-guidance installation when the prompt receives no affirmative response. This meets the install-control-surface blocking policy.

Evidence

package.jsonscripts/postinstall-mcp.mjssrc/mcp/cline-integration.jsCline MCP configurationDocuments/Cline/Rules/minitok-mcp.md.cline/skills/minitok/SKILL.md

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-mcp.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

README.mdView file

•Run `npm run readiness:all` for all three deterministic, local-only customer-facing checks. The authoritative generated VSIX is `extension/artifacts/minitok-extension-<extension-version>.vsix`; stale or unrelated VSIX candidates remain diagnostic only and are never deleted. `npm run readiness:checks` remains an alias. Use `node scripts/readiness-checks.mjs --target extension|cli|mcp --json` to run one surface. Stage 3 checks include versioned VSIX presence and manifest consistency, npm dry-run runtime files, bin and Node engine metadata, CLI help and non-TTY behavior, the packaged MCP stdio entrypoint and token-file session binding, plus localhost HTTP authentication, per-session isolation, and authenticated non-secret `/metrics` monitoring. `PASS` means local evidence was found, `BLOCKED`

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

src/cli/commands/auth.jsView file

108patternName = generic_password severity = medium line = 108

Medium

Secret Pattern

Package contains a possible secret pattern.

src/cli/commands/auth.jsView on unpkg · L108

bin/minitok.jsView file

2"use strict"; L3: const { Command } = require("commander"); L4: const pkg = require("../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/minitok.jsView on unpkg · L2

src/llm/provider.jsView file

5L6: const dns = require("dns").promises; L7: const net = require("net"); ... L25: try { L26: const text = await res.text(); L27: if (!text) return ""; ... L139: pinned.hostname = address.includes(":") ? `[${address}]` : address; L140: return { dispatcher: require("undici").ProxyAgent ? new (require("undici").ProxyAgent)({ uri: process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || proces... L141: } ... L414: const headers = this._requestHeaders(auth, apiKey, { "x-api-key": apiKey, "anthropic-version": "2023-06-01" }); L415: const res = await fetchWithTimeout(`${endpointTransport.url}/v1/messages`, { method: "POST", headers, body: JSON.stringify(body), signal: options.signal, timeout_ms: options.timeou... L416: if (!res.ok) throw providerError("Anthropic", res.

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/llm/provider.jsView on unpkg · L5

src/auth/oauth.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @flotic/minitok@1.4.0 matchedIdentity = npm:QGZsb3RpYy9taW5pdG9r:1.4.0 similarity = 0.650 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/auth/oauth.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 1-33json

1{

2 "name": "@flotic/minitok",

3 "version": "1.4.12",

4 "description": "Verified coding workflows for the terminal",

5 "main": "src/index.js",

6 "bin": {

7 "minitok": "bin/minitok.js"

8 },

9 "publishConfig": {

10 "access": "public"

11 },

12 "scripts": {

13 "postinstall": "node scripts/postinstall-mcp.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

14 "gui": "node bin/minitok.js gui",

15 "package:cli": "node scripts/artifact-report.mjs cli",

16 "sync:version-metadata": "node scripts/sync-version-metadata.mjs",

17 "check:version-metadata": "node scripts/sync-version-metadata.mjs --check",

18 "sync:extension-runtime": "npm run sync:version-metadata && node scripts/sync-extension-runtime.mjs",

19 "package:extension": "npm run sync:extension-runtime && node scripts/package-extension.mjs",

20 "release:extension": "npm run typecheck:extension && npm run extension:commercial:check && npm run extension:marketplace:check && npm run package:extension && npm run release:artifacts",

21 "typecheck:extension": "tsc -p extension/tsconfig.json",

22 "artifact:report": "node scripts/artifact-report.mjs report",

23 "artifact:runtime": "node scripts/artifact-report.mjs runtime",

24 "artifact:http": "node scripts/artifact-report.mjs http",

25 "demo:transcript": "node scripts/demo-transcript.mjs",

26 "community:preview": "node scripts/community-submission.mjs",

27 "promotion:preview": "node scripts/promotion-preview.mjs bundle",

28 "promotion:discovery": "node scripts/promotion-preview.mjs discovery",

29 "promotion:trust": "node scripts/promotion-preview.mjs trust",

30 "promotion:demo": "node scripts/promotion-demo.mjs",

31 "benchmark:validate": "node scripts/real-benchmark-validate.mjs",

32 "video:kit": "node scripts/video-kit.mjs",

33 "pretest": "node scripts/sweep-temp.mjs --older-than 2h --max-entries 500 --max-scan 50000 --time-budget 3s --quiet",

README.mdView file

•Run `npm run readiness:all` for all three deterministic, local-only customer-facing checks. The authoritative generated VSIX is `extension/artifacts/minitok-extension-<extension-version>.vsix`; stale or unrelated VSIX candidates remain diagnostic only and are never deleted. `npm run readiness:checks` remains an alias. Use `node scripts/readiness-checks.mjs --target extension|cli|mcp --json` to run one surface. Stage 3 checks include versioned VSIX presence and manifest consistency, npm dry-run runtime files, bin and Node engine metadata, CLI help and non-TTY behavior, the packaged MCP stdio entrypoint and token-file session binding, plus localhost HTTP authentication, per-session isolation, and authenticated non-secret `/metrics` monitoring. `PASS` means local evidence was found, `BLOCKED`

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

src/cli/commands/auth.jsView file

Lines 88-121javascript

88async function customerLogout(server) {

89 const session = loadCustomerSession();

90 let remoteRevoked = false;

91

bin/minitok.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2"use strict";

3const { Command } = require("commander");

4const pkg = require("../package.json");

Medium

src/llm/provider.jsView file

Lines 1-25javascript

1"use strict";

2

3const FETCH_TIMEOUT_MS = 300000; // Allow slow reasoning providers up to five minutes

4const MAX_RESPONSE_BYTES = 2 * 1024 *

src/auth/oauth.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @flotic/minitok@1.4.0 matchedIdentity = npm:QGZsb3RpYy9taW5pdG9r:1.4.0 similarity = 0.650 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/auth/oauth.jsView on unpkg