Loading npm security reports…

@tokenade/cli@1.1.18: Clean npm security report (Allow) | LPM Firewall

registry / @tokenade/cli / 1.1.18

@tokenade/cli@1.1.18

Tokenade — cut your AI coding agent's token bill. Installs the Tokenade CLI (a local, paid token-reduction tool; activate via your browser).

AI Security Review

scanned 11d ago · by lpm-firewall-ai

No attack surface was established in the reviewed JavaScript. Install-time work downloads or validates the publisher binary and probes --version; agent registration is left to a later user command.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall runs node install.js; the tokenade command runs only when the user invokes the bin shim.

Impact

A normal install adds the local CLI binary. No credential harvest, hidden recipient, or agent-config write appears in these sources.

Mechanism

The script prefers a same-version platform optional package, otherwise downloads a manifest-described tarball from the Tokenade downloads host, checks SHA-256, extracts it under vendor, and spawnSyncs --version.

AI rationale

The lifecycle scripts implement a first-party CLI binary install and a user-invoked launcher, with the download host aligned to the package and no agent-control writes in this source. The opaque binary and uninstall helper are package-scoped and do not show a separate exfiltration or hijack chain.

Decision evidence

public snapshot

AI called this Clean at 78.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

postinstall and preuninstall only launch local install.js and uninstall.js; dependencies are tar plus same-version platform optional packages, not this package name.

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

13scripts.postinstall = node install.js Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution. L13: * proxy, CI with flaky egress, Alpine containers. The three things that break a L14: * "can't download" install in the field, in order: (1) an HTTPS proxy that L15: * node:https does NOT honour on its own, (2) no timeout so a black-holed socket L16: * hangs forever, (3) no retry so one blip is fatal. We handle all three, and on L17: * failure we print enough context (platform, target, url, proxy, http status) L18: * that the cause is obvious instead of a bare "ECONNREFUSED". ... L25: const os = require("node:os"); L26: const http = require("node:http"); L27: const https = require("node:https"); L

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L13

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.jsView file

25const os = require("node:os"); L26: const http = require("node:http"); L27: const https = require("node:https"); ... L36: const DOWNLOADS_BASE = L37: process.env.TOKENADE_DOWNLOADS_BASE || "https://downloads.tokenade.net"; L38: const MANIFEST_URL = `${DOWNLOADS_BASE}/manifest.json`; L39: const VENDOR = path.join(__dirname, "vendor"); L40: ... L82: if (read < 4) throw new Error(`${label}: binary truncated (${read} bytes)`); L83: if (!looksLikeExecutable(head, process.platform)) { L84: const hex = head.slice(0, 4).toString("hex"); ... L88: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

install.jsView on unpkg · L25

25const os = require("node:os"); L26: const http = require("node:http"); L27: const https = require("node:https"); ... L36: const DOWNLOADS_BASE = L37: process.env.TOKENADE_DOWNLOADS_BASE || "https://downloads.tokenade.net"; L38: const MANIFEST_URL = `${DOWNLOADS_BASE}/manifest.json`; L39: const VENDOR = path.join(__dirname, "vendor"); L40: ... L82: if (read < 4) throw new Error(`${label}: binary truncated (${read} bytes)`); L83: if (!looksLikeExecutable(head, process.platform)) { L84: const hex = head.slice(0, 4).toString("hex"); ... L88: }

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

install.jsView on unpkg · L25

•matchType = normalized_sha256 matchedPackage = @tokenade/cli@1.1.13 matchedPath = install.js matchedIdentity = npm:QHRva2VuYWRlL2NsaQ:1.1.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

bin/tokenade.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/tokenade.js#virtual:normalized:round1View on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-33json

1{

2 "name": "@tokenade/cli",

3 "version": "1.1.18",

4 "description": "Tokenade — cut your AI coding agent's token bill. Installs the Tokenade CLI (a local, paid token-reduction tool; activate via your browser).",

5 "homepage": "https://tokenade.net",

6 "license": "SEE LICENSE IN LICENSE",

7 "bin": {

8 "tokenade": "bin/tokenade.js"

9 },

10 "scripts": {

11 "postinstall": "node install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "preuninstall": "node uninstall.js"

13 },

14 "dependencies": {

15 "tar": "^7.5.16"

16 },

17 "optionalDependencies": {

18 "@tokenade/cli-linux-x64": "1.1.18",

19 "@tokenade/cli-linux-x64-musl": "1.1.18",

20 "@tokenade/cli-linux-arm64-musl": "1.1.18",

21 "@tokenade/cli-darwin-arm64": "1.1.18",

22 "@tokenade/cli-darwin-x64": "1.1.18",

23 "@tokenade/cli-win32-x64": "1.1.18",

24 "@tokenade/cli-win32-arm64": "1.1.18"

25 },

26 "files": [

27 "bin/",

28 "platform.js",

29 "install.js",

30 "uninstall.js",

31 "README.md",

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L13

32 "LICENSE"

33 ],

install.jsView file

Lines 5-45javascript

5 * into ./vendor. The bin shim in ./bin execs it.

6 *

7 * Closed-source commercial binary, distributed via the npm registry (the trust

8 * anchor) — same pattern as esbuild/

bin/tokenade.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/tokenade.js#virtual:normalized:round1View on unpkg