token-goat@2.6.16: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

token-goat@2.6.16: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

README.mdView file

•Token-goat intercepts every Read, Fetch, and Bash call the AI makes. For Read and Bash, it does not filter or sanitize content before passing it to the model; doing so would silently break legitimate use cases. WebFetch is the one exception: every fetched page is scanned for a set of imperative-override attack patterns ("ignore previous instructions," "reveal system prompt," and similar), and a match is wrapped in an untrusted-content fence rather than passed through untouched (`injection.enabled`, on by default). Outside of that scan, the primary defense is the model's own training to treat tool output as data, not as commands from a trusted party.

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

dist/token-goat-hook.mjsView file

858// src/util.ts L859: import { spawn, spawnSync } from "node:child_process"; L860: import { chmodSync, closeSync, copyFileSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs"...

High

Child Process

Package source references child process execution.

dist/token-goat-hook.mjsView on unpkg · L858

4216{ pattern: /^cat\s+\S+\.(java|py|ts|tsx|js|jsx|go|rb|rs|cpp|cc|cxx|c|h|hpp|kt|swift|cs|php|scala|clj)\s*$/, recallHint: "--tail 50" }, L4217: // PowerShell read-only system-state queries (stable over 60-120s) L4218: {

High

Shell

Package source references shell execution.

dist/token-goat-hook.mjsView on unpkg · L4216

858// src/util.ts L859: import { spawn, spawnSync } from "node:child_process"; L860: import { chmodSync, closeSync, copyFileSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs"... ... L1079: // Only ever refresh the token already on disk; never (re)create the file. This preserves the ownership check in withFileLock's finally block unchanged -- the heartbeat never chang... L1080: if (fs.readFileSync(lockPath, 'utf8') === token) fs.writeFileSync(lockPath, token) L1081: } catch {} ... L14750: } L14751: function pathRewrite(path23, rewriter, baseUrl, metadata, elem) { L14752: const modifiedPath = typeof rewriter === "function" ? rewriter(path23, metadata, elem) : path23;

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/token-goat-hook.mjsView on unpkg · L858

1import { createRequire as __cjsRequire } from 'node:module'; L2: const require = __cjsRequire(import.meta.url); L3:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/token-goat-hook.mjsView on unpkg · L1

dist/token-goat.mjsView file

•path = dist/token-goat.mjs kind = oversized_source_file sizeBytes = 2997131 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/token-goat.mjsView on unpkg

•path = dist/token-goat.mjs kind = oversized_cli_entrypoint sizeBytes = 2997131 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/token-goat.mjsView on unpkg

Source & flagged code

7 flagged

README.mdView file

•Token-goat intercepts every Read, Fetch, and Bash call the AI makes. For Read and Bash, it does not filter or sanitize content before passing it to the model; doing so would silently break legitimate use cases. WebFetch is the one exception: every fetched page is scanned for a set of imperative-override attack patterns ("ignore previous instructions," "reveal system prompt," and similar), and a match is wrapped in an untrusted-content fence rather than passed through untouched (`injection.enabled`, on by default). Outside of that scan, the primary defense is the model's own training to treat tool output as data, not as commands from a trusted party.

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

dist/token-goat-hook.mjsView file

858// src/util.ts L859: import { spawn, spawnSync } from "node:child_process"; L860: import { chmodSync, closeSync, copyFileSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs"...

High

Child Process

Package source references child process execution.

dist/token-goat-hook.mjsView on unpkg · L858

4216{ pattern: /^cat\s+\S+\.(java|py|ts|tsx|js|jsx|go|rb|rs|cpp|cc|cxx|c|h|hpp|kt|swift|cs|php|scala|clj)\s*$/, recallHint: "--tail 50" }, L4217: // PowerShell read-only system-state queries (stable over 60-120s) L4218: {

High

Shell

Package source references shell execution.

dist/token-goat-hook.mjsView on unpkg · L4216

858// src/util.ts L859: import { spawn, spawnSync } from "node:child_process"; L860: import { chmodSync, closeSync, copyFileSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs"... ... L1079: // Only ever refresh the token already on disk; never (re)create the file. This preserves the ownership check in withFileLock's finally block unchanged -- the heartbeat never chang... L1080: if (fs.readFileSync(lockPath, 'utf8') === token) fs.writeFileSync(lockPath, token) L1081: } catch {} ... L14750: } L14751: function pathRewrite(path23, rewriter, baseUrl, metadata, elem) { L14752: const modifiedPath = typeof rewriter === "function" ? rewriter(path23, metadata, elem) : path23;

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/token-goat-hook.mjsView on unpkg · L858

1import { createRequire as __cjsRequire } from 'node:module'; L2: const require = __cjsRequire(import.meta.url); L3:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/token-goat-hook.mjsView on unpkg · L1

dist/token-goat.mjsView file

•path = dist/token-goat.mjs kind = oversized_source_file sizeBytes = 2997131 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/token-goat.mjsView on unpkg

•path = dist/token-goat.mjs kind = oversized_cli_entrypoint sizeBytes = 2997131 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/token-goat.mjsView on unpkg