registry / Credential exfiltration / @ooples/token-optimizer-mcp / 7.3.0

@ooples/token-optimizer-mcp@7.3.0

Audit net MCP context avoided per AI coding agent, optimize context, and share a live local knowledge graph across 16 CLI clients

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The source confirms conditional forwarding of an existing Anthropic credential to an unrestricted configured endpoint, which warrants a warning under the credential-forwarding policy. The evidence does not establish a hidden package-controlled recipient or a concrete malicious chain that would justify blocking.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A Stop harvest runs while a key is available and remote harvesting has not been disabled.

Impact

If the configured endpoint is not trusted, it can receive the service credential and private session details. The endpoint is configurable and the source does not restrict remote destinations.

Mechanism

The package accepts a configurable endpoint, treats a remote Anthropic-dialect endpoint as eligible for the ambient ANTHROPIC_API_KEY, and sends that key with the digest.

AI rationale

Evidence

hooks-core/harvest.mjshooks-core/harvest-worker.mjshooks-core/stop-harvest.mjs

Network endpoints1

api.anthropic.com/v1/messages

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The harvest uses an environment-selected endpoint, and remote harvesting is enabled when an API key exists unless the user opts out.
The key lookup falls back to the existing ANTHROPIC_API_KEY; for remote Anthropic-dialect endpoints, that key can be attached to the request.
The HTTP request posts the digest and sends the credential in an x-api-key header.
The default digest includes user prompts, touched file paths, commands, and assistant conclusions; full transcript transfer is separately opt-in.

Evidence against

The endpoint defaults to Anthropic’s API, and the package allows users to configure a gateway or proxy.
The ordinary digest omits file contents and tool results; the raw transcript delta requires a separate opt-in.
The package postinstall skips automatic setup for local installs and CI; global setup is delegated to its installer.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Source & flagged code

15 flagged

package.jsonView file

Lines 34-74json

34 "integrations/**/*",

35 "plugin/**/*",

36 "scripts/**/*",

37 "!**/logs/**",

38 "!**/*.log",

39 "!**/.cache/**",

40 "!**/.token-optimizer/**",

41 "!**/*.db",

42 "!**/*.db-*",

43 "!**/*.sqlite",

44 "!**/*.sqlite-*",

45 "!**/*.sqlite3",

46 "!**/*.sqlite3-*",

47 "!**/*.tmp",

48 "!**/*.temp",

49 "!**/.token-optimizer-edit-*.lock",

50 "!**/.env",

51 "!**/.env.*"

52 ],

53 "scripts": {

54 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 "checksums": "node scripts/checksums.mjs",

56 "screenshots": "node scripts/capture-screenshots.mjs",

57 "uninstall-hooks": "node scripts/uninstall.mjs",

58 "doctor": "node scripts/doctor.mjs",

59 "diagnostics": "node scripts/export-diagnostics.mjs",

60 "projects:discover": "node scripts/discover-project-graphs.mjs",

61 "build": "tsc && npm run copy:assets",

62 "copy:assets": "node scripts/copy-assets.mjs",

63 "start": "node dist/server/index.js",

64 "dev": "tsc --watch",

65 "clean": "rm -rf dist",

66 "prepublishOnly": "npm run clean && npm run build",

67 "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js",

68 "test:watch": "node --experimental-vm-modules node_modules/jest/bin/jest.js --watch",

69 "test:ci": "node --experimental-vm-modules node_modules/jest/bin/jest.js --ci --coverage --maxWorkers=2",

70 "test:coverage": "node --experimental-vm-modules node_modules/jest/bin/jest.js --coverage",

71 "test:integration": "node --experimental-vm-modules node_modules/jest/bin/jest.js tests/integration",

72 "test:unit": "node --experimental-vm-modules node_modules/jest/bin/jest.js tests/unit",

73 "test:benchmark": "node --experimental-vm-modules node_modules/jest/bin/jest.js tests/benchmarks",

74 "dashboard": "node dist/server/web-server.js",

hooks-core/skeleton.mjsView file

Lines 9-49javascript

9 * can be strictly BETTER than the file:

10 *

11 * auth.ts -- 91 KB, structure + what we know

12 * function

hooks-core/harvest.mjs#virtual:normalized:round1View file

254* Calls the model. Returns [] on any failure -- a harvest that errors must be L255: * indistinguishable, from the caller"s side, from a session with nothing to\n * learn. `harvestFailure()` carries why, for the diagnostics that do care.\n */\n/**\n * The findings ... L256: * joining argv with single spaces and no quoting at all, which breaks the

High

Shell

Package source references shell execution.

hooks-core/harvest.mjs#virtual:normalized:round1View on unpkg · L254

294// the prompt-file route exists to keep off a Windows command line: L295: // cmd.exe cannot carry a newline inside an argument, and the quoting L296: // doubles every `"`. These CLIs document the flag value as being\n // APPENDED to stdin, so the whole payload rides stdin and the argument\n // is one line of ASCII that any...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

hooks-core/harvest.mjs#virtual:normalized:round1View on unpkg · L294

294Trigger-reachable command-output exfiltration chain: manifest.bin -> scripts/doctor.mjs -> hooks-core/doctor.mjs -> hooks-core/harvest.mjs L294: // the prompt-file route exists to keep off a Windows command line: L295: // cmd.exe cannot carry a newline inside an argument, and the quoting L296: // doubles every `"`. These CLIs document the flag value as being\n // APPENDED to stdin, so the whole payload rides stdin and the argument\n // is one line of ASCII that any...

dist/compress/onnx.jsView file

Lines 41-81javascript

41 return hash % vocabSize;

42 });

43 };

44}

45/**

46 * Loads a model and returns an encoder over it.

47 *

48 * Throws if `onnxruntime-node` is absent or the model will not load, because

49 * this is called once at startup by a caller who explicitly asked for a model.

dist/tools/configuration/smart-env.jsView file

Lines 78-118javascript

78 await this.cacheResult(cacheKey, result);

79 const executionTime = Date.now() - startTime;

80 result.metadata.executionTime = executionTime;

81 this

hooks-core/harvest.mjsView file

Lines 4-44javascript

4 * Runs at Stop/PreCompact against a cheap model, in a separate process, so the

5 * session doing the work never pays for the harvest. Without an API key the

6 * whole thing is skipped and the graph keeps its structural layer, which is the

7 * majority of its machinery and costs nothing.

plugin/hooks/lib/restore.mjsView file

3contains invisible/control Unicode U+FEFF (zero width no-break space) <U+FEFF>/**

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

plugin/hooks/lib/restore.mjsView on unpkg · L3

install-hooks.ps1View file

•path = install-hooks.ps1 kind = build_helper sizeBytes = 21337 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-hooks.ps1View on unpkg

dist/analysis/project-analyzer.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 23

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/analysis/project-analyzer.jsView on unpkg

cli-wrapper.mjsView file

•matchType = normalized_sha256 matchedPackage = @ooples/token-optimizer-mcp@6.0.2 matchedPath = cli-wrapper.mjs matchedIdentity = npm:[redacted]:6.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli-wrapper.mjsView on unpkg

dist/tools/build-systems/smart-docker.jsView file

•matchType = normalized_sha256 matchedPackage = @ooples/token-optimizer-mcp@6.0.2 matchedPath = dist/tools/build-systems/smart-docker.js matchedIdentity = npm:[redacted]:6.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/build-systems/smart-docker.jsView on unpkg

dist/tools/build-systems/smart-network.jsView file

•matchType = normalized_sha256 matchedPackage = @ooples/token-optimizer-mcp@6.0.2 matchedPath = dist/tools/build-systems/smart-network.js matchedIdentity = npm:[redacted]:6.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/build-systems/smart-network.jsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

hooks-core/skeleton.mjsView file

29L30: import { execFileSync } from 'node:child_process'; L31: import { dirname } from 'node:path';

High

Child Process

Package source references child process execution.

hooks-core/skeleton.mjsView on unpkg · L29

Findings

1 Critical10 High6 Medium7 Low

CriticalTrojan Source Unicodeplugin/hooks/lib/restore.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processhooks-core/skeleton.mjs

HighShellhooks-core/harvest.mjs#virtual:normalized:round1

HighSame File Env Network Executionhooks-core/harvest.mjs

HighCommand Output Exfiltrationhooks-core/harvest.mjs#virtual:normalized:round1

HighTrigger Reachable Command Output Exfiltrationhooks-core/harvest.mjs#virtual:normalized:round1

HighSemantic Analysis Limiteddist/analysis/project-analyzer.js

HighKnown Malware Source Similaritycli-wrapper.mjs

HighKnown Malware Source Similaritydist/tools/build-systems/smart-docker.js

Affected versions and remediation

This report applies to @ooples/token-optimizer-mcp@7.3.0.

See all versions of @ooples/token-optimizer-mcp for other recorded verdicts.

Review the evidence and your use of @ooples/token-optimizer-mcp@7.3.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 10:10:01.676Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code