registry / Credential exfiltration / @ooples/token-optimizer-mcp / 7.4.3

@ooples/token-optimizer-mcp@7.4.3

Audit net MCP context avoided per AI coding agent, optimize context, and share a live local knowledge graph across 16 CLI clients

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Remote harvesting can forward an existing Anthropic credential to an unrestricted configured endpoint, creating conditional credential exposure. The user can opt out, and no source evidence establishes a package-controlled recipient or concealed theft.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Harvesting runs with a remote endpoint and an available API key, unless the user opts out.

Impact

A configured third-party endpoint may receive the ambient service credential and session digest; the source does not establish that the recipient is package-controlled.

Mechanism

The endpoint is configurable, and the remote Anthropic-format path may select ANTHROPIC_API_KEY and attach it to the HTTP request.

AI rationale

Evidence

hooks-core/harvest.mjshooks-core/harvest-worker.mjs

Network endpoints2

api.anthropic.com/v1/messagesTOKEN_OPTIMIZER_HARVEST_ENDPOINT

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The harvest endpoint can be set through TOKEN_OPTIMIZER_HARVEST_ENDPOINT.
For a remote Anthropic-format endpoint, credentialFor falls back to ANTHROPIC_API_KEY when no package-specific key is set.
The HTTP request sends that credential in the x-api-key header to the selected endpoint.
A configured key activates remote harvesting unless the user opts out; the worker sends a digest containing prompts, file paths, commands, and conclusions.
Full transcript deltas require a separate opt-in; the default digest omits tool results and file contents.

Evidence against

The postinstall hook requires TOKEN_OPTIMIZER_AUTO_INSTALL=1 before installing CLI integrations.
Local endpoints and OpenAI-format endpoints do not receive the ambient Anthropic key through credentialFor.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

Source & flagged code

15 flagged

package.jsonView file

Lines 42-82json

42 "!integrations/**/lib/**",

43 "plugin/**/*",

44 "scripts/**/*",

45 "!**/logs/**",

46 "!**/*.log",

47 "!**/.cache/**",

48 "!**/.token-optimizer/**",

49 "!**/*.db",

50 "!**/*.db-*",

51 "!**/*.sqlite",

52 "!**/*.sqlite-*",

53 "!**/*.sqlite3",

54 "!**/*.sqlite3-*",

55 "!**/*.tmp",

56 "!**/*.temp",

57 "!**/.token-optimizer-edit-*.lock",

58 "!**/.env",

59 "!**/.env.*"

60 ],

61 "scripts": {

62 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L62

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L62

63 "checksums": "node scripts/checksums.mjs",

64 "screenshots": "node scripts/capture-screenshots.mjs",

65 "uninstall-hooks": "node scripts/uninstall.mjs",

66 "doctor": "node scripts/doctor.mjs",

67 "learn": "node dist/learn/cli.js",

68 "diagnostics": "node scripts/export-diagnostics.mjs",

69 "projects:discover": "node scripts/discover-project-graphs.mjs",

70 "build": "tsc && npm run copy:assets",

71 "copy:assets": "node scripts/copy-assets.mjs",

72 "start": "node dist/server/index.js",

73 "dev": "tsc --watch",

74 "clean": "rm -rf dist",

75 "prepublishOnly": "npm run clean && npm run build",

76 "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js",

77 "test:watch": "node --experimental-vm-modules node_modules/jest/bin/jest.js --watch",

78 "test:ci": "node --experimental-vm-modules node_modules/jest/bin/jest.js --ci --coverage --maxWorkers=2",

79 "test:coverage": "node --experimental-vm-modules node_modules/jest/bin/jest.js --coverage",

80 "test:integration": "node --experimental-vm-modules node_modules/jest/bin/jest.js tests/integration",

81 "test:unit": "node --experimental-vm-modules node_modules/jest/bin/jest.js tests/unit",

82 "test:benchmark": "node --experimental-vm-modules node_modules/jest/bin/jest.js tests/benchmarks",

hooks-core/skeleton.mjsView file

Lines 9-49javascript

9 * can be strictly BETTER than the file:

10 *

11 * auth.ts -- 91 KB, structure + what we know

12 * function

hooks-core/harvest.mjs#virtual:normalized:round1View file

255* Calls the model. Returns [] on any failure -- a harvest that errors must be L256: * indistinguishable, from the caller"s side, from a session with nothing to\n * learn. `harvestFailure()` carries why, for the diagnostics that do care.\n */\n/**\n * The findings ... L257: * joining argv with single spaces and no quoting at all, which breaks the

High

Shell

Package source references shell execution.

hooks-core/harvest.mjs#virtual:normalized:round1View on unpkg · L255

295// the prompt-file route exists to keep off a Windows command line: L296: // cmd.exe cannot carry a newline inside an argument, and the quoting L297: // doubles every `"`. These CLIs document the flag value as being\n // APPENDED to stdin, so the whole payload rides stdin and the argument\n // is one line of ASCII that any...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

hooks-core/harvest.mjs#virtual:normalized:round1View on unpkg · L295

295Trigger-reachable command-output exfiltration chain: manifest.bin -> scripts/doctor.mjs -> hooks-core/doctor.mjs -> hooks-core/harvest.mjs L295: // the prompt-file route exists to keep off a Windows command line: L296: // cmd.exe cannot carry a newline inside an argument, and the quoting L297: // doubles every `"`. These CLIs document the flag value as being\n // APPENDED to stdin, so the whole payload rides stdin and the argument\n // is one line of ASCII that any...

dist/compress/onnx.jsView file

Lines 41-81javascript

41 return hash % vocabSize;

42 });

43 };

44}

45/**

46 * Loads a model and returns an encoder over it.

47 *

48 * Throws if `onnxruntime-node` is absent or the model will not load, because

49 * this is called once at startup by a caller who explicitly asked for a model.

dist/tools/configuration/smart-env.jsView file

Lines 110-150javascript

110 // Analyze variables

111 const result = await this.analyzeEnvironment(parsed, content, options, filePath, fileHash);

112 // Cache result

113 await this.

hooks-core/harvest.mjsView file

Lines 4-44javascript

4 * Runs at Stop/PreCompact against a cheap model, in a separate process, so the

5 * session doing the work never pays for the harvest. Without an API key the

6 * whole thing is skipped and the graph keeps its structural layer, which is the

7 * majority of its machinery and costs nothing.

plugin/hooks/lib/restore.mjsView file

3contains invisible/control Unicode U+FEFF (zero width no-break space) <U+FEFF>/**

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

plugin/hooks/lib/restore.mjsView on unpkg · L3

install-hooks.ps1View file

•path = install-hooks.ps1 kind = build_helper sizeBytes = 21337 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-hooks.ps1View on unpkg

dist/analysis/project-analyzer.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 30

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/analysis/project-analyzer.jsView on unpkg

cli-wrapper.mjsView file

•matchType = normalized_sha256 matchedPackage = @ooples/token-optimizer-mcp@7.1.0 matchedPath = cli-wrapper.mjs matchedIdentity = npm:[redacted]:7.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli-wrapper.mjsView on unpkg

scripts/managed-policy.mjsView file

•matchType = normalized_sha256 matchedPackage = @ooples/token-optimizer-mcp@7.1.0 matchedPath = scripts/managed-policy.mjs matchedIdentity = npm:[redacted]:7.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/managed-policy.mjsView on unpkg

scripts/run-client.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ooples/token-optimizer-mcp@7.4.2 matchedIdentity = npm:[redacted]:7.4.2 similarity = 0.883 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/run-client.mjsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

hooks-core/skeleton.mjsView file

29L30: import { execFileSync } from 'node:child_process'; L31: import { dirname } from 'node:path';

High

Child Process

Package source references child process execution.

hooks-core/skeleton.mjsView on unpkg · L29

Findings

2 Critical9 High6 Medium7 Low

CriticalTrojan Source Unicodeplugin/hooks/lib/restore.mjs

CriticalPrevious Version Dangerous Deltascripts/run-client.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processhooks-core/skeleton.mjs

HighShellhooks-core/harvest.mjs#virtual:normalized:round1

HighSame File Env Network Executionhooks-core/harvest.mjs

HighCommand Output Exfiltrationhooks-core/harvest.mjs#virtual:normalized:round1

HighTrigger Reachable Command Output Exfiltrationhooks-core/harvest.mjs#virtual:normalized:round1

HighSemantic Analysis Limiteddist/analysis/project-analyzer.js

HighKnown Malware Source Similaritycli-wrapper.mjs

Affected versions and remediation

This report applies to @ooples/token-optimizer-mcp@7.4.3.

See all versions of @ooples/token-optimizer-mcp for other recorded verdicts.

Review the evidence and your use of @ooples/token-optimizer-mcp@7.4.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 04:16:01.878Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code