registry / Credential exfiltration / @ooples/token-optimizer-mcp / 7.4.1

@ooples/token-optimizer-mcp@7.4.1

Audit net MCP context avoided per AI coding agent, optimize context, and share a live local knowledge graph across 16 CLI clients

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Source inspection confirms conditional credential forwarding to an unrestricted configured endpoint, which warrants a warning under the credential-forwarding policy. The install hook is gated by explicit configuration, and the other inspected subprocess behavior is bounded git history collection.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A session harvest runs with remote harvesting enabled and an API key available; the endpoint can be set with TOKEN_OPTIMIZER_HARVEST_ENDPOINT.

Impact

A credential may be exposed to an operator-configured unrelated endpoint. The digest also transmits selected session information.

Mechanism

The code takes TOKEN_OPTIMIZER_API_KEY or falls back to ANTHROPIC_API_KEY, then attaches the credential to a POST request to the selected endpoint.

AI rationale

Evidence

hooks-core/harvest.mjs

Network endpoints1

api.anthropic.com/v1/messages

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Remote harvesting defaults to enabled when a service key is present; the source acknowledges that an ambient key does not establish consent to send a digest.
The harvest endpoint is configurable through an environment variable, and requests attach the selected credential without a destination allowlist.
The postinstall installer runs only with an explicit auto-install flag; a normal local install reports that it makes no changes.
The git subprocess uses fixed git arguments and a bounded timeout for repository history.

Evidence against

The harvest digest is built from selected transcript fields; the source says tool results, file bodies, and diffs are dropped.
The scanner’s child-process findings correspond to bounded git history and normal CLI server startup, not evidence of shell payload execution.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Source & flagged code

13 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

hooks-core/skeleton.mjsView file

29L30: import { execFileSync } from 'node:child_process'; L31: import { dirname } from 'node:path';

High

Child Process

Package source references child process execution.

hooks-core/skeleton.mjsView on unpkg · L29

hooks-core/harvest.mjs#virtual:normalized:round1View file

255* Calls the model. Returns [] on any failure -- a harvest that errors must be L256: * indistinguishable, from the caller"s side, from a session with nothing to\n * learn. `harvestFailure()` carries why, for the diagnostics that do care.\n */\n/**\n * The findings ... L257: * joining argv with single spaces and no quoting at all, which breaks the

High

Shell

Package source references shell execution.

hooks-core/harvest.mjs#virtual:normalized:round1View on unpkg · L255

295// the prompt-file route exists to keep off a Windows command line: L296: // cmd.exe cannot carry a newline inside an argument, and the quoting L297: // doubles every `"`. These CLIs document the flag value as being\n // APPENDED to stdin, so the whole payload rides stdin and the argument\n // is one line of ASCII that any...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

hooks-core/harvest.mjs#virtual:normalized:round1View on unpkg · L295

295Trigger-reachable command-output exfiltration chain: manifest.bin -> scripts/doctor.mjs -> hooks-core/doctor.mjs -> hooks-core/harvest.mjs L295: // the prompt-file route exists to keep off a Windows command line: L296: // cmd.exe cannot carry a newline inside an argument, and the quoting L297: // doubles every `"`. These CLIs document the flag value as being\n // APPENDED to stdin, so the whole payload rides stdin and the argument\n // is one line of ASCII that any...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/compress/onnx.jsView file

61const moduleName = 'onnxruntime-node'; L62: const ort = (await import(moduleName)); L63: const session = await ort.InferenceSession.create(modelPath);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/compress/onnx.jsView on unpkg · L61

dist/tools/configuration/smart-env.jsView file

130cacheHit: false, L131: metadata: { error: errorMessage }, L132: }); ... L160: if (!path.isAbsolute(filePath)) { L161: filePath = path.join(process.cwd(), filePath); L162: } ... L217: async analyzeEnvironment(parsed, content, options, filePath, fileHash) { L218: const environment = options.environment || this.detectEnvironment(parsed); L219: // Count variable types ... L368: }, L369: { pattern: /private|credential|auth/i, severity: 'high' }, L370: ];

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tools/configuration/smart-env.jsView on unpkg · L130

hooks-core/harvest.mjsView file

24import { randomUUID } from 'node:crypto'; L25: import { spawn } from 'node:child_process'; L26: import { harvestCliFor } from './capabilities.mjs'; ... L28: L29: const MODEL = () => process.env.TOKEN_OPTIMIZER_HARVEST_MODEL || 'claude-haiku-4-5-20251001'; L30: ... L39: const ENDPOINT = () => process.env.TOKEN_OPTIMIZER_HARVEST_ENDPOINT L40: || 'https://api.anthropic.com/v1/messages'; L41:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

hooks-core/harvest.mjsView on unpkg · L24

plugin/hooks/lib/restore.mjsView file

3contains invisible/control Unicode U+FEFF (zero width no-break space) <U+FEFF>/**

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

plugin/hooks/lib/restore.mjsView on unpkg · L3

install-hooks.ps1View file

•path = install-hooks.ps1 kind = build_helper sizeBytes = 21337 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-hooks.ps1View on unpkg

dist/analysis/project-analyzer.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 29

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/analysis/project-analyzer.jsView on unpkg

cli-wrapper.mjsView file

•matchType = normalized_sha256 matchedPackage = @ooples/token-optimizer-mcp@6.0.2 matchedPath = cli-wrapper.mjs matchedIdentity = npm:[redacted]:6.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli-wrapper.mjsView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

hooks-core/skeleton.mjsView file

29L30: import { execFileSync } from 'node:child_process'; L31: import { dirname } from 'node:path';

High

Child Process

Package source references child process execution.

hooks-core/skeleton.mjsView on unpkg · L29

Findings

1 Critical8 High6 Medium7 Low

CriticalTrojan Source Unicodeplugin/hooks/lib/restore.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processhooks-core/skeleton.mjs

HighShellhooks-core/harvest.mjs#virtual:normalized:round1

HighSame File Env Network Executionhooks-core/harvest.mjs

HighCommand Output Exfiltrationhooks-core/harvest.mjs#virtual:normalized:round1

HighTrigger Reachable Command Output Exfiltrationhooks-core/harvest.mjs#virtual:normalized:round1

HighSemantic Analysis Limiteddist/analysis/project-analyzer.js

HighKnown Malware Source Similaritycli-wrapper.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

Medium

Affected versions and remediation

This report applies to @ooples/token-optimizer-mcp@7.4.1.

See all versions of @ooples/token-optimizer-mcp for other recorded verdicts.

Review the evidence and your use of @ooples/token-optimizer-mcp@7.4.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 10:10:14.042Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code