Loading npm security reports…

sprag-cli@3.42.1: AI-agent control-surface risk | LPM Firewall

registry / sprag-cli / 3.42.1

sprag-cli@3.42.1

Sprag - a quality ratchet harness for AI coding agents: model-fitting delegation, ratchet rules, doc2md, Korean style gate. Same tool as claude-token-saver, under its new name.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically alters the user's global Claude Code configuration. It installs a package-controlled skill, command hooks, and global instructions without interactive consent during postinstall.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall

Impact

Package code can run at future Claude session starts and prompt submissions, and package-authored instructions are added to all projects.

Mechanism

Automatic global Claude Code skill, hook, and instruction installation

Policy narrative

A registry install triggers `bin/cli.js install`. The installer intentionally treats postinstall as unattended, then creates or updates a Claude Code skill and settings hooks. It also defaults to adding a package-authored harness block to the global Claude instruction file, affecting every project. This is an unconsented install-time mutation of a broad AI-agent control surface.

AI rationale

The package uses postinstall to configure global Claude Code behavior and instructions without user consent. This meets the blocking policy for install-time mutation of a broad foreign AI-agent control surface.

Evidence

package.jsonsrc/commands/install.jssrc/installer.js~/.claude/settings.json~/.claude/skills/claude-token-saver/SKILL.md~/.claude/CLAUDE.md~/.claude/CLAUDE.md.bak

Decision evidence

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/cli.js install || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/cli.js install || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/doc2md.cjsView file

28const crypto = require('node:crypto'); L29: const { spawn, spawnSync } = require('node:child_process'); L30: const ledger = require('./doc2md-ledger.cjs');

High

Child Process

Package source references child process execution.

src/doc2md.cjsView on unpkg · L28

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.42.0 matchedPath = src/doc2md.cjs matchedIdentity = npm:c3ByYWctY2xp:3.42.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/doc2md.cjsView on unpkg

24L25: const fs = require('node:fs'); L26: const os = require('node:os');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/doc2md.cjsView on unpkg · L24

src/commands/upgrade.jsView file

20// resolution to find the same npm that installed us. L21: const child = spawn(cmd, { shell: true, stdio: 'inherit' }); L22: child.on('close', (code) => resolve(code === null ? 1 : code));

High

Shell

Package source references shell execution.

src/commands/upgrade.jsView on unpkg · L20

src/seed-rules.jsView file

53try { L54: const data = JSON.parse(readFileSync(seedStatePath(), 'utf8')); L55: return data && typeof data.decided === 'object' && data.decided ? data : { decided: {} };

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/seed-rules.jsView on unpkg · L53

src/commands/feedback.jsView file

56if (auth.status !== 0) return null; L57: const res = spawnSync('gh', ['issue', 'create', '-R', REPO, '--title', title, '--body', body], L58: { encoding: 'utf8', timeout: 30_000 }); L59: if (res.status !== 0) { debug('feedback:gh', res.stderr); return null; } L60: const url = String(res.stdout).trim().split('\n').pop(); ... L67: try { L68: const params = new URLSearchParams(); L69: params.set(FORM.message, `${title}\n\n${body}`); L70: params.set(FORM.meta, meta); L71: const res = await fetch(`https://docs.google.com/forms/d/e/${FORM.id}/formResponse`, { L72: method: 'POST',

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

src/commands/feedback.jsView on unpkg · L56

21L22: import { spawnSync } from 'node:child_process'; L23: import { writeFileSync, mkdirSync } from 'node:fs'; ... L28: const REPO = 'rootstudioyaml/sprag'; L29: const ISSUES_URL = `https://github.com/${REPO}/issues`; L30: ... L47: `version: ${version}`, L48: `os: ${process.platform} ${os.release()}`, L49: `node: ${process.version}`, ... L58: { encoding: 'utf8', timeout: 30_000 }); L59: if (res.status !== 0) { debug('feedback:gh', res.stderr); return null; } L60: const url = String(res.stdout).trim().split('\n').pop();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands/feedback.jsView on unpkg · L21

56Trigger-reachable command-output exfiltration chain: scripts.postinstall -> bin/cli.js -> src/commands/feedback.js L56: if (auth.status !== 0) return null; L57: const res = spawnSync('gh', ['issue', 'create', '-R', REPO, '--title', title, '--body', body], L58: { encoding: 'utf8', timeout: 30_000 }); L59: if (res.status !== 0) { debug('feedback:gh', res.stderr); return null; } L60: const url = String(res.stdout).trim().split('\n').pop(); ... L67: try { L68: const params = new URLSearchParams(); L69: params.set(FORM.message, `${title}\n\n${body}`); L70: params.set(FORM.meta, meta); L71: const res = await fetch(`https://docs.google.com/forms/d/e/${FORM.id}/formResponse`, { L72: method: 'POST',

bin/cli.jsView file

10Install-time code directly mutates a foreign AI-agent control surface: L104: sprag uninstall remove everything install added L105: sprag harness check score the harness setup in CLAUDE.md L106: sprag harness analyze run the harness transcript analysis manually ... L251: L252: // Subcommand: harness — manage the project's CLAUDE.md harness rules. L253: // sprag harness init # write CLAUDE.md (5 sections) + ratchet.md L254: // sprag harness uninit # remove harness block from CLAUDE.md (backup kept) L255: // sprag harness check # show 🅷 N/5 + which sections are missing ... L266: // sprag compact-window # status L267: // sprag compact-window set --global # pin 200k (~/.claude/settings.json) L268: // sprag compact-window set --p

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/cli.jsView on unpkg · L10

examples/statusline-command.ps1View file

•path = examples/statusline-command.ps1 kind = build_helper sizeBytes = 1619 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/statusline-command.ps1View on unpkg

src/advice.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/advice.js#virtual:normalized:round1View on unpkg

src/update-check.jsView file

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.42.0 matchedPath = src/update-check.js matchedIdentity = npm:c3ByYWctY2xp:3.42.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/update-check.jsView on unpkg

src/litellm-budget.jsView file

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.42.0 matchedPath = src/litellm-budget.js matchedIdentity = npm:c3ByYWctY2xp:3.42.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/litellm-budget.jsView on unpkg

src/model-alias.jsView file

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.42.0 matchedPath = src/model-alias.js matchedIdentity = npm:c3ByYWctY2xp:3.42.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/model-alias.jsView on unpkg

Source & flagged code

17 flagged

package.jsonView file

Lines 1-33json

1{

2 "name": "sprag-cli",

3 "version": "3.42.1",

4 "description": "Sprag - a quality ratchet harness for AI coding agents: model-fitting delegation, ratchet rules, doc2md, Korean style gate. Same tool as claude-token-saver, under its new name.",

5 "type": "module",

6 "bin": {

7 "sprag": "bin/cli.js",

8 "claude-token-saver": "bin/cli.js"

9 },

10 "scripts": {

11 "test": "node --test",

12 "docs:statusline": "node scripts/docs-statusline.mjs",

13 "postinstall": "node bin/cli.js install || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "publish:legacy": "node scripts/publish-legacy.mjs"

15 },

16 "files": [

17 "bin/",

18 "src/",

19 "presets/",

20 "examples/",

21 "README.md",

22 "README.ko.md",

23 "LICENSE"

24 ],

25 "engines": {

26 "node": ">=18"

27 },

28 "keywords": [

29 "sprag",

30 "ratchet",

31 "harness",

32 "ai-agent",

33 "claude",

src/doc2md.cjsView file

Lines 4-48javascript

4 *

5 * A pptx or xlsx read straight into the context window is close to the worst

6 * thing a token-saving tool can allow: the bytes are unreadable to the model,

7 * so it either gets nothing useful or spends a fortune finding that out. This

8 * intercepts the Read, converts the file once, caches the result, and points

src/commands/upgrade.jsView file

Lines 1-40javascript

1/**

2 * Subcommand: upgrade — install the latest release with the package manager

3 * that put this copy on disk.

4 *

5 * claude-token-saver upgrade # refresh the check, then install

6 * claude-token-saver upgrade --print # show the command, run nothing

7 *

8 * This is the command the model runs after the user says yes to the

9 * session-start offer, so it prints the exact command it is about to execute

10 * before executing it: an install that writes outside the project should never

src/seed-rules.jsView file

Lines 33-73javascript

33 addModelRule,

34 composeRuleText,

35 loadModelRules,

36 modelRuleBaseText,

37 syncAllFiles,

38} from './model-rules.js';

39import {

40 findProjectRoot,

41 harnessListRules,

42 harnessPromote,

43

src/commands/feedback.jsView file

Lines 1-76javascript

1/**

2 * Subcommand: feedback — submit a bug report or feature request from the

3 * terminal (or from a Claude Code session) without opening a browser.

4 *

5 * sprag feedback "statusline이 IntelliJ에서 깨져요"

6 * sprag feedback --title "cache chip" "5m TTL 칩이 안 사라짐"

7 *

8 * Why this exists: GitHub issues require a logged-in browser session, and

9 * corporate networks often block github.com entirely. This command tries

10 * three transports in order and reports which one carried the message:

bin/cli.jsView file

10Install-time code directly mutates a foreign AI-agent control surface: L104: sprag uninstall remove everything install added L105: sprag harness check score the harness setup in CLAUDE.md L106: sprag harness analyze run the harness transcript analysis manually ... L251: L252: // Subcommand: harness — manage the project's CLAUDE.md harness rules. L253: // sprag harness init # write CLAUDE.md (5 sections) + ratchet.md L254: // sprag harness uninit # remove harness block from CLAUDE.md (backup kept) L255: // sprag harness check # show 🅷 N/5 + which sections are missing ... L266: // sprag compact-window # status L267: // sprag compact-window set --global # pin 200k (~/.claude/settings.json) L268: // sprag compact-window set --p

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/cli.jsView on unpkg · L10

examples/statusline-command.ps1View file

•path = examples/statusline-command.ps1 kind = build_helper sizeBytes = 1619 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/statusline-command.ps1View on unpkg

src/advice.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/advice.js#virtual:normalized:round1View on unpkg

src/update-check.jsView file

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.42.0 matchedPath = src/update-check.js matchedIdentity = npm:c3ByYWctY2xp:3.42.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/update-check.jsView on unpkg

src/litellm-budget.jsView file

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.42.0 matchedPath = src/litellm-budget.js matchedIdentity = npm:c3ByYWctY2xp:3.42.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/litellm-budget.jsView on unpkg

src/model-alias.jsView file

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.42.0 matchedPath = src/model-alias.js matchedIdentity = npm:c3ByYWctY2xp:3.42.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/model-alias.jsView on unpkg