Loading npm security reports…

@tokenade/cli@1.1.13: Malicious npm security report (Block) | LPM Firewall

registry / @tokenade/cli / 1.1.13

@tokenade/cli@1.1.13

Tokenade — cut your AI coding agent's token bill. Installs the Tokenade CLI (a local, paid token-reduction tool; activate via your browser).

AI Security Review

scanned 24d ago · by lpm-firewall-ai

Installing the package can fetch, install, and execute a native binary selected by a remote manifest. The manifest's hash is not an independent integrity check, and macOS protections are removed or bypassed before execution.

Static reason

One or more suspicious static signals were detected.

Trigger

npm automatically runs postinstall when the platform optional dependency is unavailable.

Impact

A compromised or malicious download service can run arbitrary native code during package installation.

Mechanism

Remote manifest-controlled native payload download, extraction, macOS trust modification, and execution.

Attack narrative

The postinstall lifecycle starts install.js automatically. If the optional platform package is absent, it downloads a manifest from downloads.tokenade.net, accepts the manifest-provided archive URL and hash, extracts that archive into vendor, and executes its binary. Because the hash arrives from the same unverified remote source as the payload, an attacker controlling that service can provide both a payload and matching hash. On macOS, the installer also removes quarantine and can ad-hoc sign the downloaded binary before executing it.

AI rationale

This is an automatic remote-native-code execution chain with no independent payload authentication. The installer also weakens macOS execution protections for that remote payload.

Evidence

package.jsoninstall.jsvendorvendor/tokenade

Network endpoints1

downloads.tokenade.net/manifest.json

Decision evidence

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

13scripts.postinstall = node install.js Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution. L13: * proxy, CI with flaky egress, Alpine containers. The three things that break a L14: * "can't download" install in the field, in order: (1) an HTTPS proxy that L15: * node:https does NOT honour on its own, (2) no timeout so a black-holed socket L16: * hangs forever, (3) no retry so one blip is fatal. We handle all three, and on L17: * failure we print enough context (platform, target, url, proxy, http status) L18: * that the cause is obvious instead of a bare "ECONNREFUSED". ... L25: const os = require("node:os"); L26: const http = require("node:http"); L27: const https = require("node:https"); L

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L13

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.jsView file

25const os = require("node:os"); L26: const http = require("node:http"); L27: const https = require("node:https"); ... L36: const DOWNLOADS_BASE = L37: process.env.TOKENADE_DOWNLOADS_BASE || "https://downloads.tokenade.net"; L38: const MANIFEST_URL = `${DOWNLOADS_BASE}/manifest.json`; L39: const VENDOR = path.join(__dirname, "vendor"); L40: ... L82: if (read < 4) throw new Error(`${label}: binary truncated (${read} bytes)`); L83: if (!looksLikeExecutable(head, process.platform)) { L84: const hex = head.slice(0, 4).toString("hex"); ... L88: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

install.jsView on unpkg · L25

25const os = require("node:os"); L26: const http = require("node:http"); L27: const https = require("node:https"); ... L36: const DOWNLOADS_BASE = L37: process.env.TOKENADE_DOWNLOADS_BASE || "https://downloads.tokenade.net"; L38: const MANIFEST_URL = `${DOWNLOADS_BASE}/manifest.json`; L39: const VENDOR = path.join(__dirname, "vendor"); L40: ... L82: if (read < 4) throw new Error(`${label}: binary truncated (${read} bytes)`); L83: if (!looksLikeExecutable(head, process.platform)) { L84: const hex = head.slice(0, 4).toString("hex"); ... L88: }

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

install.jsView on unpkg · L25

bin/tokenade.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/tokenade.js#virtual:normalized:round1View on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 1-33json

1{

2 "name": "@tokenade/cli",

3 "version": "1.1.13",

4 "description": "Tokenade — cut your AI coding agent's token bill. Installs the Tokenade CLI (a local, paid token-reduction tool; activate via your browser).",

5 "homepage": "https://tokenade.net",

6 "license": "SEE LICENSE IN LICENSE",

7 "bin": {

8 "tokenade": "bin/tokenade.js"

9 },

10 "scripts": {

11 "postinstall": "node install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "preuninstall": "node uninstall.js"

13 },

14 "dependencies": {

15 "tar": "^7.5.16"

16 },

17 "optionalDependencies": {

18 "@tokenade/cli-linux-x64": "1.1.13",

19 "@tokenade/cli-linux-x64-musl": "1.1.13",

20 "@tokenade/cli-linux-arm64-musl": "1.1.13",

21 "@tokenade/cli-darwin-arm64": "1.1.13",

22 "@tokenade/cli-darwin-x64": "1.1.13",

23 "@tokenade/cli-win32-x64": "1.1.13",

24 "@tokenade/cli-win32-arm64": "1.1.13"

25 },

26 "files": [

27 "bin/",

28 "platform.js",

29 "install.js",

30 "uninstall.js",

31 "README.md",

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L13

32 "LICENSE"

33 ],

install.jsView file

Lines 5-45javascript

5 * into ./vendor. The bin shim in ./bin execs it.

6 *

7 * Closed-source commercial binary, distributed via the npm registry (the trust

8 * anchor) — same pattern as esbuild/

bin/tokenade.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/tokenade.js#virtual:normalized:round1View on unpkg