Loading npm security reports…

@ooples/token-optimizer-mcp@5.5.0: AI-agent control-surface risk | LPM Firewall

registry / @ooples/token-optimizer-mcp / 5.5.0

@ooples/token-optimizer-mcp@5.5.0

Intelligent context window optimization for Claude Code - store content externally via caching and compression, freeing up your context window for what matters

AI Security Review

scanned 5d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically installs always-on AI-agent hooks and alters broad AI-client control surfaces. It also marks the current Claude workspace trusted.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install -g @ooples/token-optimizer-mcp

Impact

Subsequent AI-agent sessions execute package-controlled hooks and tool calls can be denied or redirected.

Mechanism

postinstall-launched cross-client hook and MCP configuration mutation

Policy narrative

On global installation, the postinstall script launches the bundled installer without an explicit setup command. The installer copies persistent hooks, adds commands to Claude Code's global settings for SessionStart, PreToolUse, and PreCompact, can auto-accept workspace trust, and adds the package as an MCP server to several detected AI clients. The installed PreToolUse path can return permissionDecision: deny, giving package code control over later agent tool use.

Rationale

This is concrete, unconsented postinstall mutation of foreign and broad AI-agent control surfaces, including trust state and always-on hooks. The guarded remote harvest path does not mitigate that install-time control hijack.

Evidence

package.jsonscripts/postinstall.cjsinstall-hooks.shhooks-core/wire.mjsplugin/hooks/pretooluse-router.mjsplugin/hooks/lib/policy.mjs~/.claude-global/hooks/token-optimizer/**~/.claude/settings.json

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

hooks-core/skeleton.mjsView file

29L30: import { execFileSync } from 'node:child_process'; L31: import { dirname } from 'node:path';

High

Child Process

Package source references child process execution.

hooks-core/skeleton.mjsView on unpkg · L29

dist/tools/build-systems/run-node-bin.jsView file

9* through batch files -- Node now REFUSES to spawn any `.cmd` or `.bat` unless L10: * `shell: true`, and throws EINVAL instead. Measured on this machine: every one L11: * of smart_build, smart_install, smart_lint, smart_test and smart_typecheck

High

Shell

Package source references shell execution.

dist/tools/build-systems/run-node-bin.jsView on unpkg · L9

dist/tools/code-analysis/smart-security.jsView file

162}, L163: // eval() usage L164: {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/tools/code-analysis/smart-security.jsView on unpkg · L162

dist/tools/intelligence/wiki-write.jsView file

70const [wiki, harvestWrite, curate] = await Promise.all([ L71: import(coreUrl('wiki.mjs')), L72: import(coreUrl('harvest-write.mjs')),

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/intelligence/wiki-write.jsView on unpkg · L70

dist/tools/configuration/smart-env.jsView file

98savedTokens: 0, L99: metadata: { error: errorMessage }, L100: }); ... L131: if (!path.isAbsolute(filePath)) { L132: filePath = path.join(process.cwd(), filePath); L133: } ... L188: async analyzeEnvironment(parsed, content, options, filePath, fileHash) { L189: const environment = options.environment || this.detectEnvironment(parsed); L190: // Count variable types ... L351: }, L352: { pattern: /private|credential|auth/i, severity: 'high' }, L353: ];

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tools/configuration/smart-env.jsView on unpkg · L98

scripts/verify-wiki-ui.mjsView file

123L124: const server = spawn(process.execPath, [join(ROOT, 'dist', 'server', 'web-server.js')], L125: { cwd: ROOT, stdio: 'ignore', windowsHide: true, env: { ...process.env, PORT: String(PORT) } }); L126: ... L134: // was already listening. Without this the run can pass against a stale build. L135: const status = await (await fetch(`${BASE}/api/wiki/status`)).json(); L136: if (status.dir !== GRAPH) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/verify-wiki-ui.mjsView on unpkg · L123

plugin/hooks/lib/restore.mjsView file

3contains invisible/control Unicode U+FEFF (zero width no-break space) <U+FEFF>/**

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

plugin/hooks/lib/restore.mjsView on unpkg · L3

install-hooks.ps1View file

•path = install-hooks.ps1 kind = build_helper sizeBytes = 21337 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-hooks.ps1View on unpkg

dist/analysis/project-analyzer.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/analysis/project-analyzer.jsView on unpkg

dist/server/daemon.jsView file

•matchType = normalized_sha256 matchedPackage = @ooples/token-optimizer-mcp@5.4.2 matchedPath = dist/server/daemon.js matchedIdentity = npm:[redacted]:5.4.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/daemon.jsView on unpkg

cli-wrapper.mjsView file

•matchType = normalized_sha256 matchedPackage = @ooples/token-optimizer-mcp@5.4.2 matchedPath = cli-wrapper.mjs matchedIdentity = npm:[redacted]:5.4.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli-wrapper.mjsView on unpkg

dist/tools/build-systems/smart-docker.jsView file

•matchType = normalized_sha256 matchedPackage = @ooples/token-optimizer-mcp@5.4.2 matchedPath = dist/tools/build-systems/smart-docker.js matchedIdentity = npm:[redacted]:5.4.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/build-systems/smart-docker.jsView on unpkg

dist/tools/build-systems/smart-network.jsView file

•matchType = normalized_sha256 matchedPackage = @ooples/token-optimizer-mcp@5.4.2 matchedPath = dist/tools/build-systems/smart-network.js matchedIdentity = npm:[redacted]:5.4.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/build-systems/smart-network.jsView on unpkg

dist/tools/code-analysis/smart-imports.jsView file

•matchType = normalized_sha256 matchedPackage = @ooples/token-optimizer-mcp@5.4.2 matchedPath = dist/tools/code-analysis/smart-imports.js matchedIdentity = npm:[redacted]:5.4.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/code-analysis/smart-imports.jsView on unpkg