registry  /  @softawarest/token-optimizer-installer  /  1.9.3

@softawarest/token-optimizer-installer@1.9.3

One-command installer for the Token Optimizer MCP server, skills, plugins, gateway config, and default-on instructions.

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetwork
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 42 file(s), 554 KB of source, external domains: llm-proxy.lnf.gr

Source & flagged code

3 flagged · loading source
lib/install-core.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = @softawarest/token-optimizer-installer@1.9.1 matchedIdentity = npm:[redacted]:1.9.1 similarity = 0.976 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/install-core.jsView on unpkg
3const path = require("path"); L4: const { execFileSync } = require("child_process"); L5: L6: const DEFAULT_GATEWAY_URL = "https://llm-proxy.lnf.gr/v1"; L7: const DEFAULT_LOCAL_LLM_URL = "http://localhost:8080/v1"; ... L94: function installerPaths(options = {}) { L95: const home = path.resolve(options.home || process.env.HOME || os.homedir()); L96: const installRoot = path.resolve(options.installRoot || path.join(home, ".token-optimizer")); ... L267: } L268: applyLaunchctlValues(values, options); L269: } ... L426: function readJsonFile(filePath) {
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/install-core.jsView on unpkg · L3
assets/plugin/cursor/server/start.shView file
•path = [redacted].sh kind = build_helper sizeBytes = 391 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/plugin/cursor/server/start.shView on unpkg

Findings

1 High5 Medium4 Low
HighPrevious Version Dangerous Deltalib/install-core.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencelib/install-core.js
MediumShips Build Helperassets/plugin/cursor/server/start.sh
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License