registry / AI-agent control-surface risk / claude-token-saver

claude-token-saver

Legacy name of sprag-cli (Sprag) - same tool, kept publishing so existing installs stay current. Prefer: npm i -g sprag-cli

This report shows the evidence for claude-token-saver@3.50.0. 24 of 44 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The automatic postinstall chain persistently modifies ~/.claude and registers package commands as Claude Code hooks without an install-time consent gate. This meets the install-control-surface blocking policy.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during package installation.

Impact

The package gains persistent execution in Claude Code sessions and on agent tool and prompt events without an installation-time consent prompt.

Mechanism

Automatic writes to ~/.claude settings and skill files that register package commands as hooks.

Policy narrative

The postinstall hook invokes `bin/cli.js install`. In unattended postinstall execution, the install command proceeds with automatic defaults, then writes a package-controlled skill under ~/.claude and edits ~/.claude/settings.json to register statusline and event-hook commands. Those hooks run the package during Claude Code session startup, agent/task tool use, and prompt submission. This is an unconsented lifecycle mutation of a broad AI-agent control surface.

AI rationale

Evidence

package.jsonsrc/commands/install.jssrc/installer.jssrc/paths.jsbin/cli.js~/.claude/settings.json~/.claude/skills/claude-token-saver/SKILL.md~/.claude/commands/token-monitor.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

The postinstall lifecycle runs the CLI's install subcommand automatically.
The install command treats noninteractive execution, including postinstall, as unattended and proceeds with automatic defaults.
Automatic installation creates or overwrites a package-controlled Claude skill and modifies Claude Code settings.
The installer registers command hooks for SessionStart, PostToolUse, and UserPromptSubmit in the user-wide Claude configuration.
The target configuration root is the user's ~/.claude directory, so this affects the broader AI-agent control surface.
The install command invokes the installer and reports a SessionStart hook installation.
The Claude configuration directory resolves to the user's ~/.claude path.

Evidence against

The inspected feedback network request is only reached through the explicit feedback subcommand, not the install path.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem

Source & flagged code

16 flagged

package.jsonView file

•scripts.postinstall = node bin/cli.js install || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/cli.js install || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/doc2md.cjsView file

Lines 4-48javascript

4 *

5 * A pptx or xlsx read straight into the context window is close to the worst

6 * thing a token-saving tool can allow: the bytes are unreadable to the model,

7 * so it either gets nothing useful or spends a fortune finding that out. This

8 * intercepts the Read, converts the file once, caches the result, and points

9 * the model at the .md.

10 *

11 * CommonJS on purpose. It runs from ~/.claude/ through the copied hook script,

12 * where there is no package.json to declare `"type": "module"`, which is the

13 * same reason korean-lint.cjs is written this way.

14 *

15 * Conversion is markitdown, a Python package. It cannot be an npm dependency,

16 * so a missing install is an ordinary state rather than an error: say so once,

17 * then get out of the way and let the Read proceed untouched. Failing loudly

18 * on every Read would be worse than the problem being solved, and failing

19 * silently is how graphify's `except ImportError: return ""` hid a broken

20 * converter for months.

21 */

23'use strict';

25const fs = require('node:fs');

26const os = require('node:os');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/doc2md.cjsView on unpkg · L24

27const path = require('node:path');

28const crypto = require('node:crypto');

29const { spawn, spawnSync } = require('node:child_process');

30const ledger = require('./doc2md-ledger.cjs');

High

Child Process

Package source references child process execution.

src/doc2md.cjsView on unpkg · L28

32// Formats where the original is of no use to the model. Images are absent

33// deliberately: markitdown returns nothing for them, and OCR misread resource

34// names in testing (`c5.xlarge` as `c.xlarge`), which is worse than no text at

35// all in a document where those names are the content. The model reads images

36// natively anyway.

37// `.fig` converts through openfig-core in Node rather than markitdown; see

38// fig2md.cjs for why it cannot go through the Python path.

39const TARGET_EXTENSIONS = ['.pptx', '.xlsx', '.xls', '.pdf', '.docx', '.fig'];

41// Big enough for real decks and reports, small enough that a hostile file

42// cannot make the converter the expensive part of the turn.

43const MAX_SOURCE_BYTES = 50 * 1024 * 1024;

44// A conversion larger than this costs more to read than it saves.

45const MAX_MARKDOWN_BYTES = 2 * 1024 * 1024;

46// Cold `import markitdown` measured at ~12s; conversions after that are under

47// two seconds except for very large workbooks, which the row cap handles.

48const CONVERT_TIMEOUT_MS = 120_000;

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.46.2 matchedPath = src/doc2md.cjs matchedIdentity = npm:c3ByYWctY2xp:3.46.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/doc2md.cjsView on unpkg

src/fig2md.cjsView file

31// `0.4.x` rather than `^0.4.1` on purpose: the Windows install goes through L32: // cmd.exe, where `^` is the escape character and would be eaten before npm L33: // ever saw it. The range is the same one caret means for a 0.x package.

High

Shell

Package source references shell execution.

src/fig2md.cjsView on unpkg · L31

src/seed-rules.jsView file

Lines 34-74javascript

34 addModelRule,

35 composeRuleText,

36 loadModelRules,

37 modelRuleBaseText,

38 syncAllFiles,

39} from './model-rules.js';

40import {

41 findProjectRoot,

42 harnessListRules,

43 harnessPromote,

src/commands/feedback.jsView file

56if (auth.status !== 0) return null; L57: const res = spawnSync('gh', ['issue', 'create', '-R', REPO, '--title', title, '--body', body], L58: { encoding: 'utf8', timeout: 30_000 }); L59: if (res.status !== 0) { debug('feedback:gh', res.stderr); return null; } L60: const url = String(res.stdout).trim().split('\n').pop(); ... L67: try { L68: const params = new URLSearchParams(); L69: params.set(FORM.message, `${title}\n\n${body}`); L70: params.set(FORM.meta, meta); L71: const res = await fetch(`https://docs.google.com/forms/d/e/${FORM.id}/formResponse`, { L72: method: 'POST',

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

src/commands/feedback.jsView on unpkg · L56

21L22: import { spawnSync } from 'node:child_process'; L23: import { writeFileSync, mkdirSync } from 'node:fs'; ... L28: const REPO = 'rootstudioyaml/sprag'; L29: const ISSUES_URL = `https://github.com/${REPO}/issues`; L30: ... L47: `version: ${version}`, L48: `os: ${process.platform} ${os.release()}`, L49: `node: ${process.version}`, ... L58: { encoding: 'utf8', timeout: 30_000 }); L59: if (res.status !== 0) { debug('feedback:gh', res.stderr); return null; } L60: const url = String(res.stdout).trim().split('\n').pop();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands/feedback.jsView on unpkg · L21

56Trigger-reachable command-output exfiltration chain: scripts.postinstall -> bin/cli.js -> src/commands/feedback.js L56: if (auth.status !== 0) return null; L57: const res = spawnSync('gh', ['issue', 'create', '-R', REPO, '--title', title, '--body', body], L58: { encoding: 'utf8', timeout: 30_000 }); L59: if (res.status !== 0) { debug('feedback:gh', res.stderr); return null; } L60: const url = String(res.stdout).trim().split('\n').pop(); ... L67: try { L68: const params = new URLSearchParams(); L69: params.set(FORM.message, `${title}\n\n${body}`); L70: params.set(FORM.meta, meta); L71: const res = await fetch(`https://docs.google.com/forms/d/e/${FORM.id}/formResponse`, { L72: method: 'POST',

bin/cli.jsView file

10Install-time code directly mutates a foreign AI-agent control surface: L109: sprag uninstall remove everything install added L110: sprag harness check score the harness setup in CLAUDE.md L111: sprag harness analyze run the harness transcript analysis manually ... L256: L257: // Subcommand: harness — manage the project's CLAUDE.md harness rules. L258: // sprag harness init # write CLAUDE.md (5 sections) + ratchet.md L259: // sprag harness uninit # remove harness block from CLAUDE.md (backup kept) L260: // sprag harness check # show 🅷 N/5 + which sections are missing ... L271: // sprag compact-window # status L272: // sprag compact-window set --global # pin 200k (~/.claude/settings.json) L273: // sprag compact-window set --p

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/cli.jsView on unpkg · L10

examples/statusline-command.ps1View file

•path = examples/statusline-command.ps1 kind = build_helper sizeBytes = 1918 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/statusline-command.ps1View on unpkg

src/advice.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/advice.js#virtual:normalized:round1View on unpkg

src/korean-style.jsView file

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.46.2 matchedPath = src/korean-style.js matchedIdentity = npm:c3ByYWctY2xp:3.46.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/korean-style.jsView on unpkg

src/update-check.jsView file

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.46.2 matchedPath = src/update-check.js matchedIdentity = npm:c3ByYWctY2xp:3.46.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/update-check.jsView on unpkg

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/cli.js install || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/cli.js install || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/doc2md.cjsView file

28const crypto = require('node:crypto'); L29: const { spawn, spawnSync } = require('node:child_process'); L30: const ledger = require('./doc2md-ledger.cjs');

High

Child Process

Package source references child process execution.

src/doc2md.cjsView on unpkg · L28

Findings

1 Critical11 High6 Medium5 Low

CriticalAi Agent Control Hijackbin/cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processsrc/doc2md.cjs

HighShellsrc/fig2md.cjs

HighCommand Output Exfiltrationsrc/commands/feedback.js

HighSandbox Evasion Gated Capabilitysrc/commands/feedback.js

HighTrigger Reachable Command Output Exfiltrationsrc/commands/feedback.js

HighSemantic Analysis Limitedsrc/advice.js#virtual:normalized:round1

HighKnown Malware Source Similaritysrc/doc2md.cjs

HighKnown Malware Source Similaritysrc/korean-style.js

HighKnown Malware Source Similaritysrc/update-check.js

Affected versions and remediation

This report applies to claude-token-saver@3.50.0.

The versions list below shows the verdict for each recorded version.

Avoid installing claude-token-saver@3.50.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-20 02:26:14.539Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

44 known versions

3.50.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 20, 2026, 2:16 AM 3.44.0MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 15, 2026, 12:26 AM 3.43.0MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 14, 2026, 1:02 PM 3.42.8MaliciousSoft block: AI-agent control surfaceBlockPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code