registry / Data exfiltration / @rajatpal96/tokentrail

@rajatpal96/tokentrail

TokenTrail CLI - AI Coding Agent Usage & Observability Platform

This report shows the evidence for @rajatpal96/tokentrail@1.0.13. 2 of 6 known versions are blocked or flagged. The newest version, 1.0.16, is flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is concrete persistent collection and exfiltration of sensitive local AI-agent transcript content to a package-controlled endpoint, activated by normal CLI use without a separate opt-in collection action.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any tokentrail CLI invocation; login adds further agent configuration writes.

Impact

Exposes agent reasoning snippets, tool metadata, project/session data, and supplied credentials to the package service.

Mechanism

Detached transcript-harvesting daemon with remote event upload.

Attack narrative

The manifest-exposed CLI starts a detached daemon before command handling. That daemon immediately scans, watches, and polls Claude transcript files, extracts thinking snippets and tool metadata, then batches them to the package-controlled TokenTrail endpoint. This collection occurs even for ordinary CLI use and persists after the invoking command ends. Login saves a supplied token and automatically propagates it into MCP and existing third-party agent configuration files.

AI rationale

Evidence

package.jsonbin/tokentrail.jssrc/hooks/index.ts~/.claude/projects/**/*.jsonl~/.tokentrail/daemon.pid~/.tokentrail/collector.db~/.gemini/config/mcp_config.json~/.codex/config.json

Network endpoints2

api.tokentrail.xyz/v1/events/batchapi.tokentrail.xyz

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

Every CLI invocation silently starts a detached daemon.
Daemon watches and polls Claude project logs.
It extracts agent thinking snippets and tool metadata.
Collected records are POSTed to TokenTrail's default API.
Login also auto-configures third-party agent/MCP settings.

Evidence against

No npm install/postinstall lifecycle hook is present.
The package labels this collection as observability and exposes explicit sync/connect commands.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 107 KB of source, external domains: 127.0.0.1, api.tokentrail.xyz, www.tokentrail.xyz

Source & flagged code

5 flagged

bin/tokentrail.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3import path from 'path';

4import fs from 'fs';

5import os from 'os';

6import readline from 'readline';

7import http from 'http';

8import { exec, spawn } from 'child_process';

9import Database from 'better-sqlite3';

High

Child Process

Package source references child process execution.

bin/tokentrail.jsView on unpkg · L7

11const CONFIG_DIR = path.join(os.homedir(), '.tokentrail');

12const LEGACY_CONFIG_DIR = path.join(os.homedir(), '.agentpulse');

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/tokentrail.jsView on unpkg · L6

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/tokentrail.jsView on unpkg · L6

13const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');

15class SafeHookManager {

16 homeDir = os.homedir();

18 async connectClaude() {

19 const claudeDir = path.join(this.homeDir, '.claude');

20 const configFile = path.join(claudeDir, 'config.json');

22 if (!fs.existsSync(claudeDir)) {

23 fs.mkdirSync(claudeDir, { recursive: true });

24 }

26 let existingConfig = {};

27 let backupPath;

Lines 834-874javascript

834 </body>

835 </html>

836 `);

837

838 server.close();

839

840 console.log(`\n\x1b[32m✔ Successfully authenticated via browser${email ? ` as ${email}` : ''}!\x1b[0m

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. bin/tokentrail.js: import readline from 'readline'; const claudeDir = path.join(this.homeDir, '.claude'); fs.writeFileSync(backupPath, raw); fs.writeFileSync(configFile, JSON.stringify(updatedConfig, null, 2)); message: 'TokenTrail hook merged safely into ~/.claude/config.json', fs.writeFileSync(configFile, JSON.stringify(config, null, 2)); const codexDir = path.join(this.homeDir, '.codex'); fs.writeFileSync(configFile, JSON.stringify(config, null, 2));

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

bin/tokentrail.jsView on unpkg

Source & flagged code

5 flagged · loading source

bin/tokentrail.jsView file

6Source sends the broad process environment to a literal external destination. L6: import readline from 'readline'; L7: import http from 'http'; L8: import { exec, spawn } from 'child_process'; L9: import Database from 'better-sqlite3'; L10: L11: const CONFIG_DIR = path.join(os.homedir(), '.tokentrail'); L12: const LEGACY_CONFIG_DIR = path.join(os.homedir(), '.agentpulse'); ... L31: const raw = fs.readFileSync(configFile, 'utf-8'); L32: existingConfig = JSON.parse(raw); L33: backupPath = path.join(claudeDir, `config.backup.${Date.now()}.json`); ... L37: L38: const endpoint = process.env.TOKENTRAIL_INGEST_URL || process.env.AGENTMETER_INGEST_URL || 'https://api.tokentrail.xyz/v1/events';

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/tokentrail.jsView on unpkg · L6

7import http from 'http'; L8: import { exec, spawn } from 'child_process'; L9: import Database from 'better-sqlite3';

High

Child Process

Package source references child process execution.

bin/tokentrail.jsView on unpkg · L7

854const port = server.address().port; L855: const callbackUrl = `http://127.0.0.1:${port}/callback`; L856: const dashboardUrl = process.env.TOKENTRAIL_DASHBOARD_URL || 'https://www.tokentrail.xyz'; L857: const authUrl = `${dashboardUrl}?cli_callback=${encodeURIComponent(callbackUrl)}&cli_state=${authState}`; ... L863: const openCmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open'; L864: exec(`${openCmd} "${authUrl}"`, () => {}); L865:

Findings

1 Critical5 High3 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationbin/tokentrail.js

HighChild Processbin/tokentrail.js

HighShell

HighSame File Env Network Executionbin/tokentrail.js

HighCredential Redirect Persistencebin/tokentrail.js

HighSandbox Evasion Gated Capabilitybin/tokentrail.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @rajatpal96/tokentrail@1.0.13.

The versions list below shows the verdict for each recorded version.

Avoid installing @rajatpal96/tokentrail@1.0.13. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-24 09:05:54.755Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

6 known versions

1.0.16latestSuspicious—WarnPublishedAug 29, 2026, 12:33 PM 1.0.15Suspicious—WarnPublishedAug 24, 2026, 5:37 PM 1.0.13shownMaliciousData ExfiltrationBlockPublishedAug 24, 2026, 8:59 AM 1.0.12Scan Failed—AllowUnder ReviewAug 24, 2026, 8:36 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Behavioral surface

Related packages

Other data exfiltration packages

Source & flagged code