Loading npm security reports…

tokenpincher@0.8.0: Suspicious npm security report (Warn) | LPM Firewall

registry / tokenpincher / 0.8.0

tokenpincher@0.8.0

Cut your Claude Code & Codex token bill. One line. No app.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time attack is established. Explicit CLI setup persists a Claude Code hook and optional shell wrapper; runtime proxy mode handles AI API request content locally before forwarding it upstream.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `tokenpincher init`, `shell on`, `gateway import`, `wrap`, or `proxy`.

Impact

Can persist package commands in Claude/shell configuration and process tool or API content during user-invoked use.

Mechanism

Explicit AI-agent hook, shell integration, MCP gateway, and localhost API proxy setup.

Rationale

Source establishes an explicit, broad Claude Code hook and shell persistence path, warranting a warning for lifecycle risk. It does not establish malicious behavior under the install-control-surface policy because no lifecycle script performs those mutations and the network use is package-aligned.

Evidence

package.jsondist/cli.jsdist/shell-integration.jsdist/proxy.jsdist/gateway.jsdist/mcp-client.jsdist/billing.jsdist/update-check.js~/.claude/settings.json~/.zshrc~/.bashrc~/.tokenpincher/shell.sh

Network endpoints4

registry.npmjs.org/tokenpincher/latest

Source & flagged code

2 flagged

dist/shell-integration.jsView file

Lines 1-27javascript

1/**

2 * shell-integration.ts — automatic shell wiring so users never have to type

3 * `tokenpincher wrap -- claude` by hand.

4 *

5 * Installs a tiny POSIX-sh function named `claude` into

6 * ~/.tokenpincher/shell.sh (regenerated on every install, so upgrades always

7 * pick up the current invocation), and sources it from the user's rc file

8 * (~/.zshrc or ~/.bashrc) via an idempotent marked block. The function

9 * transparently routes `claude` through the local proxy, and guards against

10 * re-wrapping nested/child invocations via TOKENPINCHER_WRAPPED.

11 */

12import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";

13import { homedir } from "node:os";

14import { join } from "node:path";

15import { resolveInvocation } from "./invocation.js";

16const TOKENPINCHER_DIR = join(homedir(), ".tokenpincher");

17export const SNIPPET_PATH = join(TOKENPINCHER_DIR, "shell.sh");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/shell-integration.jsView on unpkg · L7

18const ZSHRC_PATH = join(homedir(), ".zshrc");

19const BASHRC_PATH = join(homedir(), ".bashrc");

20const MARKER_START = "# >>> tokenpincher >>>";

21const MARKER_END = "# <<< tokenpincher <<<";

22/** Generate shell.sh's content for the current invocation. */

23function buildSnippet() {

24 const invoke = resolveInvocation();

25 return `# tokenpincher shell integration — makes \`claude\` and \`codex\` run through the local proxy

26claude() {

27 if [ -n "$TOKENPINCHER_WRAPPED" ]; then command claude "$@"; return $?; fi

dist/audit.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = tokenpincher@0.7.0 matchedIdentity = npm:dG9rZW5waW5jaGVy:0.7.0 similarity = 0.962 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/audit.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/shell-integration.jsView file

7* pick up the current invocation), and sources it from the user's rc file L8: * (~/.zshrc or ~/.bashrc) via an idempotent marked block. The function L9: * transparently routes `claude` through the local proxy, and guards against ... L15: import { resolveInvocation } from "./invocation.js"; L16: const TOKENPINCHER_DIR = join(homedir(), ".tokenpincher"); L17: export const SNIPPET_PATH = join(TOKENPINCHER_DIR, "shell.sh"); ... L46: return BASHRC_PATH; L47: const shell = process.env.SHELL ?? ""; L48: return shell.includes("zsh") ? ZSHRC_PATH : BASHRC_PATH;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/shell-integration.jsView on unpkg · L7

dist/audit.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/audit.jsView on unpkg

Source & flagged code

2 flagged

dist/shell-integration.jsView file

Lines 1-27javascript

1/**

2 * shell-integration.ts — automatic shell wiring so users never have to type

3 * `tokenpincher wrap -- claude` by hand.

4 *

5 * Installs a tiny POSIX-sh function named `claude` into

6 * ~/.tokenpincher/shell.sh (regenerated on every install, so upgrades always

7 * pick up the current invocation), and sources it from the user's rc file

8 * (~/.zshrc or ~/.bashrc) via an idempotent marked block. The function

9 * transparently routes `claude` through the local proxy, and guards against

10 * re-wrapping nested/child invocations via TOKENPINCHER_WRAPPED.

11 */

12import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";

13import { homedir } from "node:os";

14import { join } from "node:path";

15import { resolveInvocation } from "./invocation.js";

16const TOKENPINCHER_DIR = join(homedir(), ".tokenpincher");

17export const SNIPPET_PATH = join(TOKENPINCHER_DIR, "shell.sh");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/shell-integration.jsView on unpkg · L7

18const ZSHRC_PATH = join(homedir(), ".zshrc");

19const BASHRC_PATH = join(homedir(), ".bashrc");

20const MARKER_START = "# >>> tokenpincher >>>";

21const MARKER_END = "# <<< tokenpincher <<<";

22/** Generate shell.sh's content for the current invocation. */

23function buildSnippet() {

24 const invoke = resolveInvocation();

25 return `# tokenpincher shell integration — makes \`claude\` and \`codex\` run through the local proxy

26claude() {

27 if [ -n "$TOKENPINCHER_WRAPPED" ]; then command claude "$@"; return $?; fi

dist/audit.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/audit.jsView on unpkg

tokenpincher@0.8.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code