registry / @ooples/token-optimizer-mcp / 7.4.4

@ooples/token-optimizer-mcp@7.4.4

Audit net MCP context avoided per AI coding agent, optimize context, and share a live local knowledge graph across 16 CLI clients

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Normal installation does not change agent configuration, but the explicit installer can register package-owned hooks that run in later agent sessions. This fits the warning policy for first-party agent extension setup; the inspected source does not support a publish block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user runs token-optimizer-install or token-optimizer-install-client; postinstall invokes setup only when TOKEN_OPTIMIZER_AUTO_INSTALL is explicitly enabled.

Impact

The hooks can run on later session and tool events. When remote model harvesting is active and a credential is available, a bounded session digest is sent to the configured model endpoint.

Mechanism

The installer registers hooks in the configured Claude settings file or copies package hook scripts into a selected client hook directory.

AI rationale

Evidence

scripts/postinstall.cjsscripts/install-cli.mjsscripts/install-client-hooks.mjsscripts/wire-hooks.mjshooks-core/capabilities.mjshooks-core/harvest.mjs

Network endpoints1

api.anthropic.com/v1/messages

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json declares a postinstall hook, but scripts/postinstall.cjs runs the installer only when TOKEN_OPTIMIZER_AUTO_INSTALL is explicitly enabled; its ordinary install path reports no outside changes.
The named installer commands can write hooks to agent settings or copy package-owned hook files into a selected client hook directory.
The inspected integration targets identify package-owned hook locations, configuration routing, plugin discovery, and an uninstall path requiring --apply.
The semantic harvest sends a bounded digest of session information to its configured model endpoint; the README discloses that remote harvest is not opt-in and can be disabled.
The flagged doctor location is a process watchdog, and the flagged fetch uses a supplied URL with SSRF checks and cross-origin credential stripping.
The other flagged sources implement a CLI wrapper, managed-policy inspection, local session-file discovery, and graph restoration; the restore file begins with a byte-order mark followed by ordinary source.

Evidence against

A plain npm install does not activate the agent configuration changes; activation requires a named command or explicit environment opt-in.

Source & flagged code

15 flagged

package.jsonView file

Lines 42-82json

42 "!integrations/**/lib/**",

43 "plugin/**/*",

44 "scripts/**/*",

45 "!**/logs/**",

46 "!**/*.log",

47 "!**/.cache/**",

48 "!**/.token-optimizer/**",

49 "!**/*.db",

50 "!**/*.db-*",

51 "!**/*.sqlite",

52 "!**/*.sqlite-*",

53 "!**/*.sqlite3",

54 "!**/*.sqlite3-*",

55 "!**/*.tmp",

56 "!**/*.temp",

57 "!**/.token-optimizer-edit-*.lock",

58 "!**/.env",

59 "!**/.env.*"

60 ],

61 "scripts": {

62 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L62

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L62

63 "checksums": "node scripts/checksums.mjs",

64 "screenshots": "node scripts/capture-screenshots.mjs",

65 "uninstall-hooks": "node scripts/uninstall.mjs",

66 "doctor": "node scripts/doctor.mjs",

67 "learn": "node dist/learn/cli.js",

68 "diagnostics": "node scripts/export-diagnostics.mjs",

69 "projects:discover": "node scripts/discover-project-graphs.mjs",

70 "build": "tsc && npm run copy:assets",

71 "copy:assets": "node scripts/copy-assets.mjs",

72 "start": "node dist/server/index.js",

73 "dev": "tsc --watch",

74 "clean": "rm -rf dist",

75 "prepublishOnly": "npm run clean && npm run build",

76 "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js",

77 "test:watch": "node --experimental-vm-modules node_modules/jest/bin/jest.js --watch",

78 "test:ci": "node --experimental-vm-modules node_modules/jest/bin/jest.js --ci --coverage --maxWorkers=2",

79 "test:coverage": "node --experimental-vm-modules node_modules/jest/bin/jest.js --coverage",

80 "test:integration": "node --experimental-vm-modules node_modules/jest/bin/jest.js tests/integration",

81 "test:unit": "node --experimental-vm-modules node_modules/jest/bin/jest.js tests/unit",

82 "test:benchmark": "node --experimental-vm-modules node_modules/jest/bin/jest.js tests/benchmarks",

hooks-core/skeleton.mjsView file

Lines 9-49javascript

9 * can be strictly BETTER than the file:

10 *

11 * auth.ts -- 91 KB, structure + what we know

12 * function

hooks-core/harvest.mjs#virtual:normalized:round1View file

255* Calls the model. Returns [] on any failure -- a harvest that errors must be L256: * indistinguishable, from the caller"s side, from a session with nothing to\n * learn. `harvestFailure()` carries why, for the diagnostics that do care.\n */\n/**\n * The findings ... L257: * joining argv with single spaces and no quoting at all, which breaks the

High

Shell

Package source references shell execution.

hooks-core/harvest.mjs#virtual:normalized:round1View on unpkg · L255

295// the prompt-file route exists to keep off a Windows command line: L296: // cmd.exe cannot carry a newline inside an argument, and the quoting L297: // doubles every `"`. These CLIs document the flag value as being\n // APPENDED to stdin, so the whole payload rides stdin and the argument\n // is one line of ASCII that any...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

hooks-core/harvest.mjs#virtual:normalized:round1View on unpkg · L295

295Trigger-reachable command-output exfiltration chain: manifest.bin -> scripts/doctor.mjs -> hooks-core/doctor.mjs -> hooks-core/harvest.mjs L295: // the prompt-file route exists to keep off a Windows command line: L296: // cmd.exe cannot carry a newline inside an argument, and the quoting L297: // doubles every `"`. These CLIs document the flag value as being\n // APPENDED to stdin, so the whole payload rides stdin and the argument\n // is one line of ASCII that any...

dist/compress/onnx.jsView file

Lines 41-81javascript

41 return hash % vocabSize;

42 });

43 };

44}

45/**

46 * Loads a model and returns an encoder over it.

47 *

48 * Throws if `onnxruntime-node` is absent or the model will not load, because

49 * this is called once at startup by a caller who explicitly asked for a model.

dist/tools/configuration/smart-env.jsView file

Lines 110-150javascript

110 // Analyze variables

111 const result = await this.analyzeEnvironment(parsed, content, options, filePath, fileHash);

112 // Cache result

113 await this.

hooks-core/harvest.mjsView file

Lines 4-44javascript

4 * Runs at Stop/PreCompact against a cheap model, in a separate process, so the

5 * session doing the work never pays for the harvest. Without an API key the

6 * whole thing is skipped and the graph keeps its structural layer, which is the

7 * majority of its machinery and costs nothing.

plugin/hooks/lib/restore.mjsView file

3contains invisible/control Unicode U+FEFF (zero width no-break space) <U+FEFF>/**

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

plugin/hooks/lib/restore.mjsView on unpkg · L3

install-hooks.ps1View file

•path = install-hooks.ps1 kind = build_helper sizeBytes = 21337 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-hooks.ps1View on unpkg

dist/analysis/project-analyzer.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 31

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/analysis/project-analyzer.jsView on unpkg

cli-wrapper.mjsView file

•matchType = normalized_sha256 matchedPackage = @ooples/token-optimizer-mcp@7.1.0 matchedPath = cli-wrapper.mjs matchedIdentity = npm:[redacted]:7.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli-wrapper.mjsView on unpkg

scripts/managed-policy.mjsView file

•matchType = normalized_sha256 matchedPackage = @ooples/token-optimizer-mcp@7.1.0 matchedPath = scripts/managed-policy.mjs matchedIdentity = npm:[redacted]:7.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/managed-policy.mjsView on unpkg

hooks-core/capabilities.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ooples/token-optimizer-mcp@7.4.3 matchedIdentity = npm:[redacted]:7.4.3 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

hooks-core/capabilities.mjsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

hooks-core/skeleton.mjsView file

29L30: import { execFileSync } from 'node:child_process'; L31: import { dirname } from 'node:path';

High

Child Process

Package source references child process execution.

hooks-core/skeleton.mjsView on unpkg · L29

Findings

2 Critical9 High6 Medium7 Low

CriticalTrojan Source Unicodeplugin/hooks/lib/restore.mjs

CriticalPrevious Version Dangerous Deltahooks-core/capabilities.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processhooks-core/skeleton.mjs

HighShellhooks-core/harvest.mjs#virtual:normalized:round1

HighSame File Env Network Executionhooks-core/harvest.mjs

HighCommand Output Exfiltrationhooks-core/harvest.mjs#virtual:normalized:round1

HighTrigger Reachable Command Output Exfiltrationhooks-core/harvest.mjs#virtual:normalized:round1

HighSemantic Analysis Limiteddist/analysis/project-analyzer.js

HighKnown Malware Source Similaritycli-wrapper.mjs

Affected versions and remediation

This report applies to @ooples/token-optimizer-mcp@7.4.4.

See all versions of @ooples/token-optimizer-mcp for other recorded verdicts.

Review the evidence and your use of @ooples/token-optimizer-mcp@7.4.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 21:49:24.121Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

@ooples/token-optimizer-mcp@7.4.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code