registry / @ooples/token-optimizer-mcp / 5.7.0

@ooples/token-optimizer-mcp@5.7.0

⚠ Under review

Cross-client context optimization and durable live knowledge capture for AI coding agents and CLI tools

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 25 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 759 file(s), 10.8 MB of source, external domains: 127.0.0.1, ampcode.com, api.anthropic.com, cursor.com, docs.cline.bot, docs.continue.dev, docs.factory.ai, docs.windsurf.com, evil.example, generativelanguage.googleapis.com, github.com, graphml.graphdrawing.org, kilo.ai, roocodeinc.github.io, www.gstatic.com, www.w3.org, zed.dev

Source & flagged code

16 flagged

package.jsonView file

Lines 13-53json

13 },

14 "files": [

15 "dist/**/*",

16 "cli-wrapper.mjs",

17 "hooks/**/*",

18 "install-hooks.ps1",

19 "install-hooks.sh",

20 "README.md",

21 "LICENSE",

22 "CHANGELOG.md",

23 "CLI_WRAPPER_README.md",

24 "hooks-core/**/*",

25 "ucr/**/*",

26 "schemas/**/*",

27 "evals/ucr/**/*",

28 "integrations/**/*",

29 "plugin/**/*",

30 "scripts/**/*"

31 ],

32 "scripts": {

33 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 "checksums": "node scripts/checksums.mjs",

35 "screenshots": "node scripts/capture-screenshots.mjs",

36 "uninstall-hooks": "node scripts/uninstall.mjs",

37 "doctor": "node scripts/doctor.mjs",

38 "build": "tsc && npm run copy:assets",

39 "copy:assets": "node scripts/copy-assets.mjs",

40 "start": "node dist/server/index.js",

41 "dev": "tsc --watch",

42 "clean": "rm -rf dist",

43 "prepublishOnly": "npm run clean && npm run build",

44 "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js",

45 "test:watch": "node --experimental-vm-modules node_modules/jest/bin/jest.js --watch",

46 "test:ci": "node --experimental-vm-modules node_modules/jest/bin/jest.js --ci --coverage --maxWorkers=2",

47 "test:coverage": "node --experimental-vm-modules node_modules/jest/bin/jest.js --coverage",

48 "test:integration": "node --experimental-vm-modules node_modules/jest/bin/jest.js tests/integration",

49 "test:unit": "node --experimental-vm-modules node_modules/jest/bin/jest.js tests/unit",

50 "test:benchmark": "node --experimental-vm-modules node_modules/jest/bin/jest.js tests/benchmarks",

51 "dashboard": "node dist/server/web-server.js",

52 "dashboard:dev": "tsc -p tsconfig.dashboard.json && npm run copy:assets && node dist/server/web-server.js",

53 "dashboard:build": "tsc -p tsconfig.dashboard.json && npm run copy:assets",

hooks-core/skeleton.mjsView file

Lines 9-49javascript

9 * can be strictly BETTER than the file:

10 *

11 * auth.ts -- 91 KB, structure + what we know

12 * function

dist/tools/build-systems/run-node-bin.jsView file

Lines 1-29javascript

1/**

2 * Running a project's own CLI without a shell and without a `.cmd` shim.

3 *

4 * THE BUG THIS EXISTS FOR. These tools spawned `npx.cmd` on Windows with

5 * `shell: false`, which used to be exactly right: naming the shim explicitly

6 * meant caller-controlled arguments could never be reinterpreted by a shell.

7 *

8 * Node 20.12 changed that. As the fix for CVE-2024-27980 -- argument injection

9 * through batch files -- Node now REFUSES to spawn any `.cmd` or `.bat` unless

dist/tools/code-analysis/smart-security.jsView file

Lines 142-182javascript

142 '.cs',

143 '.go',

144 '.rb',

145 '.php',

146 ],

147 message: 'Hardcoded secret token detected',

dist/tools/intelligence/wiki-write.jsView file

Lines 99-139javascript

99 return {

100 success: false,

101 ...empty,

102 error: 'confidence must be greater than 0 and at most 1 when supplied',

103 };

104 }

105 const confidence

dist/tools/configuration/smart-env.jsView file

Lines 78-118javascript

78 await this.cacheResult(cacheKey, result);

79 const executionTime = Date.now() - startTime;

80 result.metadata.executionTime = executionTime;

81 this

scripts/capture-screenshots.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2/**

3 * Real screenshots of the real dashboard, for the README.

4 *

5 * Not mockups. This boots the actual web server against a seeded graph, drives

6 * a real headless Chromium, and writes PNGs -- so a screenshot that goes stale

7 * is regenerated by running this rather than redrawn by hand, and a screenshot

8 * that cannot be produced is a broken dashboard rather than a missing asset.

9 *

10 * The seed is deliberately the same shape the UI verifier uses: a contradiction,

plugin/hooks/lib/restore.mjsView file

3contains invisible/control Unicode U+FEFF (zero width no-break space) <U+FEFF>/**

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

plugin/hooks/lib/restore.mjsView on unpkg · L3

install-hooks.ps1View file

•path = install-hooks.ps1 kind = build_helper sizeBytes = 21337 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-hooks.ps1View on unpkg

dist/analysis/project-analyzer.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/analysis/project-analyzer.jsView on unpkg

dist/server/daemon.jsView file

•matchType = normalized_sha256 matchedPackage = @ooples/token-optimizer-mcp@5.6.1 matchedPath = dist/server/daemon.js matchedIdentity = npm:[redacted]:5.6.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High