Loading npm security reports…

claude-token-saver@3.50.0: AI-agent control-surface risk | LPM Firewall

registry / claude-token-saver / 3.50.0

claude-token-saver@3.50.0

Legacy name of sprag-cli (Sprag) - same tool, kept publishing so existing installs stay current. Prefer: npm i -g sprag-cli

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies the user-wide Claude Code configuration. It adds a package-controlled skill, statusline command, and hooks that execute this package during agent events.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during package installation.

Impact

The package gains persistent execution in Claude Code sessions and on agent tool and prompt events without an installation-time consent prompt.

Mechanism

Automatic writes to ~/.claude settings and skill files that register package commands as hooks.

Policy narrative

The postinstall hook invokes `bin/cli.js install`. In unattended postinstall execution, the install command proceeds with automatic defaults, then writes a package-controlled skill under ~/.claude and edits ~/.claude/settings.json to register statusline and event-hook commands. Those hooks run the package during Claude Code session startup, agent/task tool use, and prompt submission. This is an unconsented lifecycle mutation of a broad AI-agent control surface.

AI rationale

The automatic postinstall chain persistently modifies ~/.claude and registers package commands as Claude Code hooks without an install-time consent gate. This meets the install-control-surface blocking policy.

Evidence

package.jsonsrc/commands/install.jssrc/installer.jssrc/paths.jsbin/cli.js~/.claude/settings.json~/.claude/skills/claude-token-saver/SKILL.md~/.claude/commands/token-monitor.md

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/cli.js install || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/cli.js install || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/doc2md.cjsView file

28const crypto = require('node:crypto'); L29: const { spawn, spawnSync } = require('node:child_process'); L30: const ledger = require('./doc2md-ledger.cjs');

High

Child Process

Package source references child process execution.

src/doc2md.cjsView on unpkg · L28

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.46.2 matchedPath = src/doc2md.cjs matchedIdentity = npm:c3ByYWctY2xp:3.46.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/doc2md.cjsView on unpkg

24L25: const fs = require('node:fs'); L26: const os = require('node:os');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/doc2md.cjsView on unpkg · L24

src/fig2md.cjsView file

31// `0.4.x` rather than `^0.4.1` on purpose: the Windows install goes through L32: // cmd.exe, where `^` is the escape character and would be eaten before npm L33: // ever saw it. The range is the same one caret means for a 0.x package.

High

Shell

Package source references shell execution.

src/fig2md.cjsView on unpkg · L31

src/seed-rules.jsView file

54try { L55: const data = JSON.parse(readFileSync(seedStatePath(), 'utf8')); L56: return data && typeof data.decided === 'object' && data.decided ? data : { decided: {} };

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/seed-rules.jsView on unpkg · L54

src/commands/feedback.jsView file

56if (auth.status !== 0) return null; L57: const res = spawnSync('gh', ['issue', 'create', '-R', REPO, '--title', title, '--body', body], L58: { encoding: 'utf8', timeout: 30_000 }); L59: if (res.status !== 0) { debug('feedback:gh', res.stderr); return null; } L60: const url = String(res.stdout).trim().split('\n').pop(); ... L67: try { L68: const params = new URLSearchParams(); L69: params.set(FORM.message, `${title}\n\n${body}`); L70: params.set(FORM.meta, meta); L71: const res = await fetch(`https://docs.google.com/forms/d/e/${FORM.id}/formResponse`, { L72: method: 'POST',

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

src/commands/feedback.jsView on unpkg · L56

21L22: import { spawnSync } from 'node:child_process'; L23: import { writeFileSync, mkdirSync } from 'node:fs'; ... L28: const REPO = 'rootstudioyaml/sprag'; L29: const ISSUES_URL = `https://github.com/${REPO}/issues`; L30: ... L47: `version: ${version}`, L48: `os: ${process.platform} ${os.release()}`, L49: `node: ${process.version}`, ... L58: { encoding: 'utf8', timeout: 30_000 }); L59: if (res.status !== 0) { debug('feedback:gh', res.stderr); return null; } L60: const url = String(res.stdout).trim().split('\n').pop();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands/feedback.jsView on unpkg · L21

56Trigger-reachable command-output exfiltration chain: scripts.postinstall -> bin/cli.js -> src/commands/feedback.js L56: if (auth.status !== 0) return null; L57: const res = spawnSync('gh', ['issue', 'create', '-R', REPO, '--title', title, '--body', body], L58: { encoding: 'utf8', timeout: 30_000 }); L59: if (res.status !== 0) { debug('feedback:gh', res.stderr); return null; } L60: const url = String(res.stdout).trim().split('\n').pop(); ... L67: try { L68: const params = new URLSearchParams(); L69: params.set(FORM.message, `${title}\n\n${body}`); L70: params.set(FORM.meta, meta); L71: const res = await fetch(`https://docs.google.com/forms/d/e/${FORM.id}/formResponse`, { L72: method: 'POST',

bin/cli.jsView file

10Install-time code directly mutates a foreign AI-agent control surface: L109: sprag uninstall remove everything install added L110: sprag harness check score the harness setup in CLAUDE.md L111: sprag harness analyze run the harness transcript analysis manually ... L256: L257: // Subcommand: harness — manage the project's CLAUDE.md harness rules. L258: // sprag harness init # write CLAUDE.md (5 sections) + ratchet.md L259: // sprag harness uninit # remove harness block from CLAUDE.md (backup kept) L260: // sprag harness check # show 🅷 N/5 + which sections are missing ... L271: // sprag compact-window # status L272: // sprag compact-window set --global # pin 200k (~/.claude/settings.json) L273: // sprag compact-window set --p

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/cli.jsView on unpkg · L10

examples/statusline-command.ps1View file

•path = examples/statusline-command.ps1 kind = build_helper sizeBytes = 1918 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/statusline-command.ps1View on unpkg

src/advice.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/advice.js#virtual:normalized:round1View on unpkg

src/korean-style.jsView file

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.46.2 matchedPath = src/korean-style.js matchedIdentity = npm:c3ByYWctY2xp:3.46.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/korean-style.jsView on unpkg

src/update-check.jsView file

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.46.2 matchedPath = src/update-check.js matchedIdentity = npm:c3ByYWctY2xp:3.46.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/update-check.jsView on unpkg

Source & flagged code

16 flagged

package.jsonView file

Lines 1-33json

1{

2 "name": "claude-token-saver",

3 "version": "3.50.0",

4 "description": "Legacy name of sprag-cli (Sprag) - same tool, kept publishing so existing installs stay current. Prefer: npm i -g sprag-cli",

5 "type": "module",

6 "bin": {

7 "sprag": "bin/cli.js",

8 "claude-token-saver": "bin/cli.js"

9 },

10 "scripts": {

11 "deploy": "node scripts/deploy.mjs",

12 "docs:statusline": "node scripts/docs-statusline.mjs",

13 "postinstall": "node bin/cli.js install || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "publish:legacy": "node scripts/publish-legacy.mjs",

15 "release:notes": "node scripts/release-notes.mjs",

16 "site:docs": "node scripts/build-site-docs.mjs",

17 "test": "node --test"

18 },

19 "files": [

20 "bin/",

21 "src/",

22 "presets/",

23 "examples/",

24 "README.md",

25 "README.ko.md",

26 "LICENSE",

27 "NOTICE"

28 ],

29 "engines": {

30 "node": ">=18"

31 },

32 "keywords": [

33 "sprag",

src/doc2md.cjsView file

Lines 4-48javascript

4 *

5 * A pptx or xlsx read straight into the context window is close to the worst

6 * thing a token-saving tool can allow: the bytes are unreadable to the model,

7 * so it either gets nothing useful or spends a fortune finding that out. This

8 * intercepts the Read, converts the file once, caches the result, and points

src/fig2md.cjsView file

Lines 11-51javascript

11 * [openfig-core] (MIT, three small pure-JS dependencies). The parser is not

12 * bundled: this package deliberately ships with zero dependencies, so

13 * openfig-core is installed on demand into the tool

src/seed-rules.jsView file

Lines 34-74javascript

34 addModelRule,

35 composeRuleText,

36 loadModelRules,

37 modelRuleBaseText,

38 syncAllFiles,

39} from './model-rules.js';

40import {

41 findProjectRoot,

42 harnessListRules,

43 harnessPromote,

src/commands/feedback.jsView file

Lines 1-76javascript

1/**

2 * Subcommand: feedback — submit a bug report or feature request from the

3 * terminal (or from a Claude Code session) without opening a browser.

4 *

5 * sprag feedback "statusline이 IntelliJ에서 깨져요"

6 * sprag feedback --title "cache chip" "5m TTL 칩이 안 사라짐"

7 *

8 * Why this exists: GitHub issues require a logged-in browser session, and

9 * corporate networks often block github.com entirely. This command tries

10 * three transports in order and reports which one carried the message:

bin/cli.jsView file

10Install-time code directly mutates a foreign AI-agent control surface: L109: sprag uninstall remove everything install added L110: sprag harness check score the harness setup in CLAUDE.md L111: sprag harness analyze run the harness transcript analysis manually ... L256: L257: // Subcommand: harness — manage the project's CLAUDE.md harness rules. L258: // sprag harness init # write CLAUDE.md (5 sections) + ratchet.md L259: // sprag harness uninit # remove harness block from CLAUDE.md (backup kept) L260: // sprag harness check # show 🅷 N/5 + which sections are missing ... L271: // sprag compact-window # status L272: // sprag compact-window set --global # pin 200k (~/.claude/settings.json) L273: // sprag compact-window set --p

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/cli.jsView on unpkg · L10

examples/statusline-command.ps1View file

•path = examples/statusline-command.ps1 kind = build_helper sizeBytes = 1918 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/statusline-command.ps1View on unpkg

src/advice.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/advice.js#virtual:normalized:round1View on unpkg

src/korean-style.jsView file

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.46.2 matchedPath = src/korean-style.js matchedIdentity = npm:c3ByYWctY2xp:3.46.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/korean-style.jsView on unpkg

src/update-check.jsView file

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.46.2 matchedPath = src/update-check.js matchedIdentity = npm:c3ByYWctY2xp:3.46.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/update-check.jsView on unpkg