tokenoptimiser@0.1.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

tokenoptimiser@0.1.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/license.jsView file

5const fs = require("fs"); L6: const http = require("http"); L7: const https = require("https"); ... L11: const { CONFIG, SAVINGS_EVENTS } = require("./paths"); L12: const { version } = require("../package.json"); L13: ... L24: const DEVICE_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$/; L25: const BASE64URL_RE = /^[A-Za-z0-9_-]+$/; L26: ... L64: function apiBaseUrl() { L65: const raw = process.env.TOKENOPTIMISER_API_URL || DEFAULT_API; L66: let url;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/license.jsView on unpkg · L5

scripts/postinstall.jsView file

5const fs = require("node:fs"); L6: const https = require("node:https"); L7: const path = require("node:path"); L8: const { pipeline } = require("node:stream/promises"); L9: const { spawnSync } = require("node:child_process"); L10: const paths = require("../lib/paths"); ... L13: L14: const PKG_DIR = path.join(__dirname, ".."); L15: const STATE_FILE = path.join(paths.HOME, "runtime.json"); ... L21: function log(message) { L22: process.stdout.write(`[tokenoptimiser] ${message}\n`); L23: }

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.jsView on unpkg · L5

scripts/envscrub.pyView file

•path = scripts/envscrub.py kind = build_helper sizeBytes = 4149 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/envscrub.pyView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 1-27json

1{

2 "name": "tokenoptimiser",

3 "version": "0.1.0",

4 "description": "Cut your AI coding-agent token usage 60-90%. One command, no code changes.",

5 "keywords": ["claude-code", "cursor", "tokens", "llm", "cost", "proxy", "compression"],

6 "homepage": "https://tokenoptimiser.io",

7 "license": "SEE LICENSE IN LICENSE",

8 "bin": {

9 "tokenoptimiser": "bin/tokenoptimiser.js"

10 },

11 "scripts": {

12 "check": "node --check bin/tokenoptimiser.js && node --check lib/agents.js && node --check lib/engine-process.js && node --check lib/license.js && node --check lib/paths.js && node --check lib/platform.js && node --check lib/report-data.js && node --check lib/report-html.js && node --check lib/secret-input.js && node --check scripts/postinstall.js",

13 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "test": "node --test test/cli.test.js test/report.test.js"

15 },

16 "files": [

17 "bin/",

18 "lib/",

19 "scripts/engine-shim.py",

20 "scripts/envscrub.py",

21 "scripts/postinstall.js"

22 ],

23 "engines": {

24 "node": ">=18"

25 }

26}

27

lib/license.jsView file

Lines 1-25javascript

1"use strict";

2// License activation and aggregate usage metering. Pro access is granted only

3// by an Ed25519-signed entitlement from the Tokenoptimiser license authority.

4const crypto = require("crypto");

5const fs = require(

scripts/postinstall.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2"use strict";

3

4const crypto = require("node:crypto");

5const fs = require("node:fs");

scripts/envscrub.pyView file

•path = scripts/envscrub.py kind = build_helper sizeBytes = 4149 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/envscrub.pyView on unpkg