Loading npm security reports…

@ooples/token-optimizer-mcp@5.3.6: AI-agent control-surface risk | LPM Firewall

registry / @ooples/token-optimizer-mcp / 5.3.6

@ooples/token-optimizer-mcp@5.3.6

Intelligent context window optimization for Claude Code - store content externally via caching and compression, freeing up your context window for what matters

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install silently installs persistent hooks and modifies AI-agent configuration files. It also marks the current Claude project trusted and registers this package as an MCP server across several third-party AI tools.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install -g @ooples/token-optimizer-mcp

Impact

Future AI-agent sessions execute package-controlled hooks and load the package MCP server without separate user consent.

Mechanism

postinstall-driven cross-agent hook, trust, and MCP configuration mutation

Policy narrative

On global installation, postinstall launches a platform installer that writes persistent hook commands into Claude Code settings, accepts workspace trust, and registers a package-controlled MCP server in several AI products. These changes occur without an interactive approval for each control surface and cause later agent sessions to execute package code.

Rationale

This is a concrete unconsented postinstall mutation of foreign and broad AI-agent control surfaces, meeting the firewall block boundary. The nominal optimization purpose and opt-in harvesting path do not mitigate the install-time persistence and trust/config mutation.

Evidence

package.jsonscripts/postinstall.cjsinstall-hooks.shinstall-hooks.ps1scripts/wire-hooks.mjshooks-core/wire.mjsplugin/hooks/pretooluse-router.mjs~/.claude/settings.json~/.claude.json~/.claude-global/hooks/token-optimizer

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

hooks-core/skeleton.mjsView file

29L30: import { execFileSync } from 'node:child_process'; L31: import { dirname } from 'node:path';

High

Child Process

Package source references child process execution.

hooks-core/skeleton.mjsView on unpkg · L29

dist/tools/build-systems/run-node-bin.jsView file

9* through batch files -- Node now REFUSES to spawn any `.cmd` or `.bat` unless L10: * `shell: true`, and throws EINVAL instead. Measured on this machine: every one L11: * of smart_build, smart_install, smart_lint, smart_test and smart_typecheck

High

Shell

Package source references shell execution.

dist/tools/build-systems/run-node-bin.jsView on unpkg · L9

dist/tools/code-analysis/smart-security.jsView file

162}, L163: // eval() usage L164: {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/tools/code-analysis/smart-security.jsView on unpkg · L162

dist/tools/intelligence/wiki-write.jsView file

63const [wiki, harvestWrite, curate] = await Promise.all([ L64: import(coreUrl('wiki.mjs')), L65: import(coreUrl('harvest-write.mjs')),

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/intelligence/wiki-write.jsView on unpkg · L63

hooks-core/metrics.mjsView file

34function holdoutFraction() { L35: const raw = Number(process.env.TOKEN_OPTIMIZER_HOLDOUT); L36: return Number.isFinite(raw) && raw >= 0 && raw <= 1 ? raw : 0.1; ... L73: // Same restriction as the graph directory: metrics name real file paths L74: // from a private codebase. L75: mkdirSync(dir, { recursive: true, mode: 0o700 }); ... L125: const read = readSync(fd, buffer, 0, MAX_BYTES, size - MAX_BYTES); L126: text = buffer.subarray(0, read).toString('utf8'); L127: } finally { ... L245: netTokens: sufficient ? estimatedAvoided - injectedTokens - harvestTokens : null, L246: sufficientData: sufficient, L247: verdict: !sufficient

Low

Weak Crypto

Package source references weak cryptographic algorithms.

hooks-core/metrics.mjsView on unpkg · L34

scripts/verify-wiki-ui.mjsView file

123L124: const server = spawn(process.execPath, [join(ROOT, 'dist', 'server', 'web-server.js')], L125: { cwd: ROOT, stdio: 'ignore', windowsHide: true, env: { ...process.env, PORT: String(PORT) } }); L126: ... L134: // was already listening. Without this the run can pass against a stale build. L135: const status = await (await fetch(`${BASE}/api/wiki/status`)).json(); L136: if (status.dir !== GRAPH) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/verify-wiki-ui.mjsView on unpkg · L123

install-hooks.ps1View file

•path = install-hooks.ps1 kind = build_helper sizeBytes = 19659 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-hooks.ps1View on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 10-50json

10 "token-optimizer-daemon": "./dist/server/daemon.js",

11 "token-optimizer-install": "./scripts/install-cli.mjs",

12 "token-optimizer-doctor": "./scripts/doctor.mjs"

13 },

14 "files": [

15 "dist/**/*",

16 "cli-wrapper.mjs",

17 "hooks/**/*",

18 "install-hooks.ps1",

19 "install-hooks.sh",

20 "README.md",

21 "LICENSE",

22 "CHANGELOG.md",

23 "CLI_WRAPPER_README.md",

24 "hooks-core/**/*",

25 "integrations/**/*",

26 "plugin/**/*",

27 "scripts/**/*"

28 ],

29 "scripts": {

30 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 "checksums": "node scripts/checksums.mjs",

32 "screenshots": "node scripts/capture-screenshots.mjs",

33 "uninstall-hooks": "node scripts/uninstall.mjs",

34 "doctor": "node scripts/doctor.mjs",

35 "build": "tsc && npm run copy:assets",

36 "copy:assets": "node -e \"const{cpSync,mkdirSync}=require('fs');cpSync('src/dashboard/public','dist/dashboard/public',{recursive:true});mkdirSync('dist/dashboard/public/vendor',{recursive:true});cpSync('node_modules/chart.js/dist/chart.umd.js','dist/dashboard/public/vendor/chart.umd.min.js')\"",

37 "start": "node dist/server/index.js",

38 "dev": "tsc --watch",

39 "clean": "rm -rf dist",

40 "prepublishOnly": "npm run clean && npm run build",

41 "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js",

42 "test:watch": "node --experimental-vm-modules node_modules/jest/bin/jest.js --watch",

43 "test:ci": "node --experimental-vm-modules node_modules/jest/bin/jest.js --ci --coverage --maxWorkers=2",

44 "test:coverage": "node --experimental-vm-modules node_modules/jest/bin/jest.js --coverage",

45 "test:integration": "node --experimental-vm-modules node_modules/jest/bin/jest.js tests/integration",

46 "test:unit": "node --experimental-vm-modules node_modules/jest/bin/jest.js tests/unit",

47 "test:benchmark": "node --experimental-vm-modules node_modules/jest/bin/jest.js tests/benchmarks",

48 "dashboard": "node dist/server/web-server.js",

49 "dashboard:dev": "tsc -p tsconfig.dashboard.json && npm run copy:assets && node dist/server/web-server.js",

50 "dashboard:build": "tsc -p tsconfig.dashboard.json && npm run copy:assets",

hooks-core/skeleton.mjsView file

Lines 9-49javascript

9 * can be strictly BETTER than the file:

10 *

11 * auth.ts -- 91 KB, structure + what we know

12 * function

dist/tools/build-systems/run-node-bin.jsView file

Lines 1-29javascript

1/**

2 * Running a project's own CLI without a shell and without a `.cmd` shim.

3 *

4 * THE BUG THIS EXISTS FOR. These tools spawned `npx.cmd` on Windows with

5 * `shell: false`, which used to be exactly right: naming the shim explicitly

6 * meant caller-controlled arguments could never be reinterpreted by a shell.

7 *

8 * Node 20.12 changed that. As the fix for CVE-2024-27980 -- argument injection

9 * through batch files -- Node now REFUSES to spawn any `.cmd` or `.bat` unless

10

dist/tools/code-analysis/smart-security.jsView file

Lines 142-182javascript

142 '.cs',

143 '.go',

144 '.rb',

145 '.php',

146 ],

147 message: 'Hardcoded secret token detected',

dist/tools/intelligence/wiki-write.jsView file

Lines 43-83javascript

43 const anchors = Array.isArray(options?.anchors)

44 ? options.anchors.filter((a) => typeof a === 'string' && a.

hooks-core/metrics.mjsView file

Lines 14-54javascript

14 * during some epochs and the treated arm in others. The comparison becomes

15 * within-file, which removes the dominant source of variance and makes the

16 * number mean something at far lower volume.

17 */

18

19import {

scripts/verify-wiki-ui.mjsView file

Lines 103-143javascript

103}

104

105/**

106 * Copies the dashboard assets into dist before launching.

107 *

108 * The server serves from dist/, not src/. Without this the script cheerfully

109 * verifies the PREVIOUS build and reports whatever the last one did -- which is

110 * worse than not running it, because it produces a confident pass on code that

111 * is not the code under test. (Learned the direct way: a CSS fix appeared not

112 * to work for a full run because dist still held the old file.)

install-hooks.ps1View file

•path = install-hooks.ps1 kind = build_helper sizeBytes = 19659 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-hooks.ps1View on unpkg