claude-token-saver@3.24.0
renamed to sprag-cli - same tool, same releases. Switch with: npm uninstall -g claude-token-saver && npm i -g sprag-cli
Route the easy work your expensive Claude model keeps repeating down to haiku/sonnet — post-hoc session analysis, no realtime router, no extra LLM calls.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe postinstall hook automatically invokes setup that writes persistent Claude Code skill and hook configuration before any consent gate. This meets the policy for blocking unconsented install-time mutation of an AI-agent control surface.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package through npm, which runs its postinstall hook.
Impact
Claude Code receives persistent package-provided instructions and hooks without an explicit setup action, altering its behavior in future sessions.
Mechanism
The lifecycle command invokes the CLI install subcommand; that command calls installAll before consent handling, which installs the skill, statusline, and session hooks.
Policy narrative
The package's npm postinstall invokes its CLI installer. The installer calls installAll before its consent prompt gates execution, and installAll writes a Claude Code auto-trigger skill and configures session hooks and the statusline. This establishes unconsented lifecycle mutation of an AI-agent control surface.
AI rationale
The postinstall hook automatically invokes setup that writes persistent Claude Code skill and hook configuration before any consent gate. This meets the policy for blocking unconsented install-time mutation of an AI-agent control surface.
Evidence
package.jsonsrc/commands/install.jssrc/installer.jsbin/cli.js
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs the CLI install command automatically during postinstall.
- The install command calls installAll before any consent prompt can gate that call.
- installAll writes an auto-trigger skill and configures statusline, SessionStart, and UserPromptSubmit hooks.
- The CLI describes the skill as making Claude respond automatically to matching user wording.
Evidence against
- No source evidence inspected establishes credential theft, external exfiltration, or remote payload execution.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/cli.js install || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/cli.js install || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/cli.jsView file
10Install-time code directly mutates a foreign AI-agent control surface:
L146:
L147: // Subcommand: harness — manage the project's CLAUDE.md harness rules.
L148: // claude-token-saver harness init # write CLAUDE.md (5 sections) + ratchet.md
L149: // claude-token-saver harness uninit # remove harness block from CLAUDE.md (backup kept)
L150: // claude-token-saver harness check # show 🅷 N/5 + which sections are missing
...
L161: // claude-token-saver compact-window # status
L162: // claude-token-saver compact-window set --global # pin 200k (~/.claude/settings.json)
L163: // claude-token-saver compact-window set --project # pin 200k (<root>/.claude/settings.json)
L164: // claude-token-saver compact-window off | on # toggle the status
Findings
1 Critical5 High4 Medium4 Low
CriticalAi Agent Control Hijackbin/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedsrc/advice.js#virtual:normalized:round1
HighKnown Malware Source Similaritysrc/korean-style.js
HighKnown Malware Source Similaritysrc/model-alias.js
HighPrevious Version Dangerous Deltasrc/korean-style.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Build Helperexamples/statusline-command.ps1
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to claude-token-saver@3.24.0.
See all versions of claude-token-saver for other recorded verdicts.
- Avoid installing claude-token-saver@3.24.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.