registry / Remote code execution / tokenoptimiser
tokenoptimiser
Cut your AI coding-agent token usage 60-90%. One command, no code changes.
This report shows the evidence for tokenoptimiser@0.1.2. 1 of 3 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe automatic remote executable/wheel chain is paired with deliberate concealment and post-install rewriting, establishing a concrete stealthy staged-payload behavior. Embedded hashes do not independently establish trust because the package supplies both URLs and expected hashes.
Static reason
One or more suspicious static signals were detected.
Trigger
npm install (postinstall); later tokenoptimiser connect commands
Impact
Arbitrary remote wheel behavior runs during installation; the package also prepares a hidden AI-agent proxy runtime.
Mechanism
verified-but-package-controlled remote payload staging, execution, and concealment
Attack narrative
Installation automatically downloads a platform executable and private wheel from URLs controlled by the bundled manifest, creates a managed Python environment, installs the wheel, and runs a scrubber over its site-packages. The scrubber removes a dashboard and rewrites branding; the CLI and shim explicitly conceal the engine name and suppress its setup output. The downloaded wheel is not present for source inspection, so its executed behavior is opaque.
AI rationale
The automatic remote executable/wheel chain is paired with deliberate concealment and post-install rewriting, establishing a concrete stealthy staged-payload behavior. Embedded hashes do not independently establish trust because the package supplies both URLs and expected hashes.
Evidence
package.jsonscripts/postinstall.jslib/runtime-manifest.jsonscripts/envscrub.pyscripts/engine-shim.pybin/tokenoptimiser.js
Network endpoints2
github.com/astral-sh/uv/releases/download/0.11.32/pkg.tokenoptimiser.io/files/0.31.0-r2/
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs scripts/postinstall.js automatically.
- scripts/postinstall.js downloads and executes opaque uv and engine-wheel payloads.
- scripts/envscrub.py rewrites installed dependencies and removes the engine dashboard.
- bin/tokenoptimiser.js and scripts/engine-shim.py deliberately hide the engine identity and setup output.
Evidence against
- Downloaded artifacts are SHA-256 checked against the bundled manifest.
- License traffic is limited to the package API and explicit license operations.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkglib/license.jsView file
5const fs = require("fs");
L6: const http = require("http");
L7: const https = require("https");
...
L11: const { CONFIG, SAVINGS_EVENTS } = require("./paths");
L12: const { version } = require("../package.json");
L13:
...
L24: const DEVICE_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$/;
L25: const BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
L26:
...
L64: function apiBaseUrl() {
L65: const raw = process.env.TOKENOPTIMISER_API_URL || DEFAULT_API;
L66: let url;
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
lib/license.jsView on unpkg · L5scripts/postinstall.jsView file
5const fs = require("node:fs");
L6: const https = require("node:https");
L7: const path = require("node:path");
L8: const { pipeline } = require("node:stream/promises");
L9: const { spawnSync } = require("node:child_process");
L10: const paths = require("../lib/paths");
...
L13:
L14: const PKG_DIR = path.join(__dirname, "..");
L15: const STATE_FILE = path.join(paths.HOME, "runtime.json");
...
L21: function log(message) {
L22: process.stdout.write(`[tokenoptimiser] ${message}\n`);
L23: }
High
Install Named Payload File
Install-named source file stages remote content through filesystem writes and execution.
scripts/postinstall.jsView on unpkg · L5scripts/envscrub.pyView file
•path = scripts/envscrub.py
kind = build_helper
sizeBytes = 7437
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
scripts/envscrub.pyView on unpkgFindings
3 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitylib/license.js
HighInstall Named Payload Filescripts/postinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/envscrub.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to tokenoptimiser@0.1.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing tokenoptimiser@0.1.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.