registry / Data exfiltration / @ooples/token-optimizer-mcp / 7.5.1

@ooples/token-optimizer-mcp@7.5.1

Audit net MCP context avoided per AI coding agent, optimize context, and share a live local knowledge graph across 16 CLI clients

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Source inspection confirms a conditional runtime transfer of prompt and command metadata to a model endpoint, enabled by default when an API key is present and disabled by an opt-out. Because hook activation requires setup outside an ordinary npm install and the default digest excludes tool results and file bodies, this supports a warning rather than a publication block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

After explicit hook setup, an edited session reaches its Stop hook while harvesting is enabled and an API key is available.

Impact

Session text and activity metadata may leave the machine; the default digest excludes tool results and file bodies.

Mechanism

The worker reads the transcript, builds a digest containing prompts and commands, then posts it to the configured endpoint.

AI rationale

Evidence

hooks-core/stop-harvest.mjshooks-core/harvest-worker.mjshooks-core/harvest.mjspackage.jsonscripts/postinstall.cjsscripts/install-cli.mjs

Network endpoints1

api.anthropic.com/v1/messages

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The npm postinstall hook starts integration setup only when TOKEN_OPTIMIZER_AUTO_INSTALL is enabled.
The installer registers hooks when the install CLI is run.
After an edited session, the Stop hook starts a worker that proceeds when a transcript exists and harvesting is enabled.
The default digest includes user prompts and commands; raw transcript mode is separately opt-in.
Harvesting is disabled by an explicit opt-out; otherwise a configured API key enables remote mode.
The worker sends the digest in a POST request to the configured endpoint, which defaults to Anthropic’s Messages API.

Evidence against

A regular npm install does not by itself activate the hooks; the lifecycle setup requires an environment opt-in or a separate install command.
The default digest omits tool results and file bodies, and the endpoint is configurable.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Source & flagged code

15 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

hooks-core/skeleton.mjsView file

29L30: import { execFileSync } from 'node:child_process'; L31: import { dirname } from 'node:path';

High

Child Process

Package source references child process execution.

hooks-core/skeleton.mjsView on unpkg · L29

hooks-core/harvest.mjs#virtual:normalized:round1View file

255* Calls the model. Returns [] on any failure -- a harvest that errors must be L256: * indistinguishable, from the caller"s side, from a session with nothing to\n * learn. `harvestFailure()` carries why, for the diagnostics that do care.\n */\n/**\n * The findings ... L257: * joining argv with single spaces and no quoting at all, which breaks the

High

Shell

Package source references shell execution.

hooks-core/harvest.mjs#virtual:normalized:round1View on unpkg · L255

295// the prompt-file route exists to keep off a Windows command line: L296: // cmd.exe cannot carry a newline inside an argument, and the quoting L297: // doubles every `"`. These CLIs document the flag value as being\n // APPENDED to stdin, so the whole payload rides stdin and the argument\n // is one line of ASCII that any...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

hooks-core/harvest.mjs#virtual:normalized:round1View on unpkg · L295

295Trigger-reachable command-output exfiltration chain: manifest.bin -> scripts/doctor.mjs -> hooks-core/doctor.mjs -> hooks-core/harvest.mjs L295: // the prompt-file route exists to keep off a Windows command line: L296: // cmd.exe cannot carry a newline inside an argument, and the quoting L297: // doubles every `"`. These CLIs document the flag value as being\n // APPENDED to stdin, so the whole payload rides stdin and the argument\n // is one line of ASCII that any...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/compress/onnx.jsView file

61const moduleName = 'onnxruntime-node'; L62: const ort = (await import(moduleName)); L63: const session = await ort.InferenceSession.create(modelPath);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/compress/onnx.jsView on unpkg · L61

dist/tools/configuration/smart-env.jsView file

130cacheHit: false, L131: metadata: { error: errorMessage }, L132: }); ... L160: if (!path.isAbsolute(filePath)) { L161: filePath = path.join(process.cwd(), filePath); L162: } ... L217: async analyzeEnvironment(parsed, content, options, filePath, fileHash) { L218: const environment = options.environment || this.detectEnvironment(parsed); L219: // Count variable types ... L368: }, L369: { pattern: /private|credential|auth/i, severity: 'high' }, L370: ];

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tools/configuration/smart-env.jsView on unpkg · L130

hooks-core/harvest.mjsView file

24import { randomUUID } from 'node:crypto'; L25: import { spawn } from 'node:child_process'; L26: import { harvestCliFor } from './capabilities.mjs'; ... L28: L29: const MODEL = () => process.env.TOKEN_OPTIMIZER_HARVEST_MODEL || 'claude-haiku-4-5-20251001'; L30: ... L39: const ENDPOINT = () => process.env.TOKEN_OPTIMIZER_HARVEST_ENDPOINT L40: || 'https://api.anthropic.com/v1/messages'; L41:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

hooks-core/harvest.mjsView on unpkg · L24

plugin/hooks/lib/restore.mjsView file

3contains invisible/control Unicode U+FEFF (zero width no-break space) <U+FEFF>/**

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

plugin/hooks/lib/restore.mjsView on unpkg · L3

install-hooks.ps1View file

•path = install-hooks.ps1 kind = build_helper sizeBytes = 21337 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-hooks.ps1View on unpkg

dist/analysis/project-analyzer.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 31

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/analysis/project-analyzer.jsView on unpkg

cli-wrapper.mjsView file

•matchType = normalized_sha256 matchedPackage = @ooples/token-optimizer-mcp@7.1.0 matchedPath = cli-wrapper.mjs matchedIdentity = npm:[redacted]:7.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli-wrapper.mjsView on unpkg

scripts/managed-policy.mjsView file

•matchType = normalized_sha256 matchedPackage = @ooples/token-optimizer-mcp@7.1.0 matchedPath = scripts/managed-policy.mjs matchedIdentity = npm:[redacted]:7.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/managed-policy.mjsView on unpkg

hooks-core/doctor.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ooples/token-optimizer-mcp@7.5.0 matchedIdentity = npm:[redacted]:7.5.0 similarity = 0.925 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

hooks-core/doctor.mjsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

hooks-core/skeleton.mjsView file

29L30: import { execFileSync } from 'node:child_process'; L31: import { dirname } from 'node:path';

High

Child Process

Package source references child process execution.

hooks-core/skeleton.mjsView on unpkg · L29

Findings

2 Critical9 High6 Medium7 Low

CriticalTrojan Source Unicodeplugin/hooks/lib/restore.mjs

CriticalPrevious Version Dangerous Deltahooks-core/doctor.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processhooks-core/skeleton.mjs

HighShellhooks-core/harvest.mjs#virtual:normalized:round1

HighSame File Env Network Executionhooks-core/harvest.mjs

HighCommand Output Exfiltrationhooks-core/harvest.mjs#virtual:normalized:round1

HighTrigger Reachable Command Output Exfiltrationhooks-core/harvest.mjs#virtual:normalized:round1

HighSemantic Analysis Limiteddist/analysis/project-analyzer.js

HighKnown Malware Source Similaritycli-wrapper.mjs

Affected versions and remediation

This report applies to @ooples/token-optimizer-mcp@7.5.1.

See all versions of @ooples/token-optimizer-mcp for other recorded verdicts.

Review the evidence and your use of @ooples/token-optimizer-mcp@7.5.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 05:23:55.054Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code