claude-token-saver@3.10.0
renamed to sprag-cli - same tool, same releases. Switch with: npm uninstall -g claude-token-saver && npm i -g sprag-cli
Route the easy work your expensive Claude model keeps repeating down to haiku/sonnet — post-hoc session analysis, no realtime router, no extra LLM calls.
AI Security Review
scanned 11d ago · by lpm-firewall-aiSource confirms that npm postinstall automatically runs an installer that writes a package-controlled Claude Code skill and registers session and prompt hooks. This unconsented install-time mutation of an agent control surface meets the blocking policy.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Installing the package through npm runs its postinstall hook.
Impact
Claude Code can automatically load package-authored skill instructions and execute package commands during later sessions and prompts.
Mechanism
The hook invokes the install command, which writes the package-controlled skill and registers SessionStart and UserPromptSubmit commands in Claude Code settings.
Policy narrative
During npm installation, postinstall invokes the package's install command. That command writes a Claude Code skill and configures commands to run on session start and prompt submission. These changes persist into subsequent Claude Code use and occur without an explicit setup action by the user.
AI rationale
Source confirms that npm postinstall automatically runs an installer that writes a package-controlled Claude Code skill and registers session and prompt hooks. This unconsented install-time mutation of an agent control surface meets the blocking policy.
Evidence
package.jsonsrc/commands/install.jssrc/installer.js~/.claude/skills/claude-token-saver/SKILL.md~/.claude/settings.json
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs the CLI install command automatically during postinstall.
- That command invokes installAll without a user interaction or consent check.
- installAll writes a package-controlled Claude Code skill and registers statusline and session hooks in the user's Claude configuration.
- The hooks run package commands at session start and on prompt submission, creating an automatic foreign AI-agent control surface.
Evidence against
- The integration targets Claude Code and uses commands belonging to this package.
- The installer preserves other hooks and leaves an existing different statusline command alone unless forced.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/cli.js install || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/cli.js install || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/cli.jsView file
10Install-time code directly mutates a foreign AI-agent control surface:
L136:
L137: // Subcommand: harness — manage the project's CLAUDE.md harness rules.
L138: // claude-token-saver harness init # write CLAUDE.md (5 sections) + ratchet.md
L139: // claude-token-saver harness uninit # remove harness block from CLAUDE.md (backup kept)
L140: // claude-token-saver harness check # show 🅷 N/5 + which sections are missing
...
L151: // claude-token-saver compact-window # status
L152: // claude-token-saver compact-window set --global # pin 200k (~/.claude/settings.json)
L153: // claude-token-saver compact-window set --project # pin 200k (<root>/.claude/settings.json)
L154: // claude-token-saver compact-window off | on # toggle the status
Findings
1 Critical3 High4 Medium4 Low
CriticalAi Agent Control Hijackbin/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedsrc/advice.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltasrc/model-alias.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Build Helperexamples/statusline-command.ps1
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to claude-token-saver@3.10.0.
See all versions of claude-token-saver for other recorded verdicts.
- Avoid installing claude-token-saver@3.10.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.