Loading npm security reports…

tokenshield-contextplus@1.0.13: AI-agent control-surface risk | LPM Firewall

registry / tokenshield-contextplus / 1.0.13

tokenshield-contextplus@1.0.13

AI Coding Token Economizer & Model Fatigue Shield for Cursor, Claude Code, Windsurf & VS Code

AI Security Review

scanned 5d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An automatic silent postinstall modifies user-level configurations across multiple AI agents. It registers the package as an executable MCP server without consent.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation runs the postinstall self-install command.

Impact

Future agent sessions can load the package's tools through silently altered user-level controls.

Mechanism

The CLI unconditionally calls global registration, which creates configuration directories and writes its MCP server entry into foreign agent configurations.

Policy narrative

Installing the package invokes silent self-install. That command registers a Node MCP server pointing to the installed CLI in multiple user-level agent configurations. The node_modules check only suppresses workspace arming; it does not prevent global writes. No consent gate precedes these changes, so installation alters agent controls beyond the package's own configuration.

AI rationale

Inspected source proves unconsented postinstall mutation of broad, foreign AI-agent control surfaces, meeting the supplied blocking policy. The verdict rests on this executable chain rather than scanner labels or unproven credential exfiltration.

Evidence

package.jsonbin/cli.js.cursor/mcp.json.claude.json.codeium/windsurf/mcp_config.json.gemini/config/mcp_config.json.gemini/antigravity-ide/mcp/tokenshield/mcp.json

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/cli.js self-install --silent || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/cli.js self-install --silent || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cli.jsView file

11const os = require('os'); L12: const { execSync, spawn, execFileSync } = require('child_process'); L13: const readline = require('readline'); ... L17: L18: const HOME_DIR = os.homedir(); L19: const CONFIG_DIR = path.join(HOME_DIR, '.tokenshield'); L20: const VAULT_FILE = path.join(CONFIG_DIR, 'vault.json'); L21: const LICENSE_SERVER = process.env.TOKENSHIELD_LICENSE_SERVER || 'https://praveenojha.com/api/store/license/verify'; L22: ... L38: try { L39: const v = JSON.parse(fs.readFileSync(VAULT_FILE, 'utf8')); L40: if (!v.machineFingerprint) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/cli.jsView on unpkg · L11

24if (!fs.existsSync(CONFIG_DIR)) { L25: fs.mkdirSync(CONFIG_DIR, { recursive: true }); L26: } ... L28: // Resolve the active workspace for the whole process tree. The Python core writes L29: // telemetry/session state to <workspace>/.agents/telemetry so the IDE dashboard, L30: // CLI, and core scripts all read/write ONE live file. ... L60: }; L61: fs.writeFileSync(VAULT_FILE, JSON.stringify(defaultVault, null, 2)); L62: // Background sync with central license server in case this machine previously used trial tokens ... L69: function saveVault(data) { L70: fs.writeFileSync(VAULT_FILE, JSON.stringify(data, null, 2)); L71: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/cli.jsView on unpkg · L24

11Trigger-reachable chain: scripts.postinstall -> bin/cli.js L11: const os = require('os'); L12: const { execSync, spawn, execFileSync } = require('child_process'); L13: const readline = require('readline'); ... L17: L18: const HOME_DIR = os.homedir(); L19: const CONFIG_DIR = path.join(HOME_DIR, '.tokenshield'); L20: const VAULT_FILE = path.join(CONFIG_DIR, 'vault.json'); L21: const LICENSE_SERVER = process.env.TOKENSHIELD_LICENSE_SERVER || 'https://praveenojha.com/api/store/license/verify'; L22: ... L38: try { L39: const v = JSON.parse(fs.readFileSync(VAULT_FILE, 'utf8')); L40: if (!v.machineFingerprint) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/cli.jsView on unpkg · L11

11const os = require('os'); L12: const { execSync, spawn, execFileSync } = require('child_process'); L13: const readline = require('readline');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L11

11const os = require('os'); L12: const { execSync, spawn, execFileSync } = require('child_process'); L13: const readline = require('readline'); ... L20: const VAULT_FILE = path.join(CONFIG_DIR, 'vault.json'); L21: const LICENSE_SERVER = process.env.TOKENSHIELD_LICENSE_SERVER || 'https://praveenojha.com/api/store/license/verify'; L22:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/cli.jsView on unpkg · L11

11const os = require('os'); L12: const { execSync, spawn, execFileSync } = require('child_process'); L13: const readline = require('readline'); ... L17: L18: const HOME_DIR = os.homedir(); L19: const CONFIG_DIR = path.join(HOME_DIR, '.tokenshield'); L20: const VAULT_FILE = path.join(CONFIG_DIR, 'vault.json'); L21: const LICENSE_SERVER = process.env.TOKENSHIELD_LICENSE_SERVER || 'https://praveenojha.com/api/store/license/verify'; L22: ... L38: try { L39: const v = JSON.parse(fs.readFileSync(VAULT_FILE, 'utf8')); L40: if (!v.machineFingerprint) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/cli.jsView on unpkg · L11

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ipts', scriptname), path.join(__dirname, scriptname) ]; for (const p of candidates) { if (fs.existssync(p)) return p; } return null; } function runcorescript(scriptname, args = []) { const scriptpath = findcorescript(scriptname); if (!scriptpath) { console.error(`${c.red}❌ error: core engine script not found: ${scriptname}${c.reset}`); return; } const pycmd = getpythoncommand(); try { const res = spawn(pycmd, [scriptpath, ...args], { stdio: 'inherit' }); res.on('exit', (code) => { if (code === 0) { sendtelemetryheartbeat({ invocations: 1 }); } if (code !== 0) process.exit(code); }); } catch (err) { co

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/cli.jsView on unpkg

core/audio_context_compressor.pyView file

•path = core/audio_context_compressor.py kind = build_helper sizeBytes = 38038 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/audio_context_compressor.pyView on unpkg

core/setup_agent_tools.shView file

•matchType = normalized_sha256 matchedPackage = tokenshield-contextplus@1.0.9 matchedPath = core/setup_agent_tools.sh matchedIdentity = npm:dG9rZW5zaGllbGQtY29udGV4dHBsdXM:1.0.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/setup_agent_tools.shView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 1-31json

1{

2 "name": "tokenshield-contextplus",

3 "version": "1.0.13",

4 "description": "AI Coding Token Economizer & Model Fatigue Shield for Cursor, Claude Code, Windsurf & VS Code",

5 "main": "bin/cli.js",

6 "bin": {

7 "tokenshield": "bin/cli.js",

8 "contextplus": "bin/cli.js"

9 },

10 "scripts": {

11 "postinstall": "node bin/cli.js self-install --silent || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "test": "node --test test/",

13 "sync:version": "node scripts/sync-version.js",

14 "build:plugin": "node scripts/build-plugin.js"

15 },

16 "files": [

17 "bin",

18 "core",

19 "assets",

20 "README.md",

21 "GUIDE.md",

22 "LICENSE.md",

23 "modules",

24 "skills",

25 "test"

26 ],

27 "keywords": [

28 "cursor",

29 "claude-code",

30 "windsurf",

31 "token-saver",

bin/cli.jsView file

Lines 1-44javascript

1#!/usr/bin/env node

2

3/**

4 * TokenShield & Context++ — Developer CLI

5 * ========================================

6 * Universal AI Coding Token Economizer & Model Fatigue Shield

7 */

8

9const fs = require('fs');

core/audio_context_compressor.pyView file

•path = core/audio_context_compressor.py kind = build_helper sizeBytes = 38038 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/audio_context_compressor.pyView on unpkg

core/setup_agent_tools.shView file

•matchType = normalized_sha256 matchedPackage = tokenshield-contextplus@1.0.9 matchedPath = core/setup_agent_tools.sh matchedIdentity = npm:dG9rZW5zaGllbGQtY29udGV4dHBsdXM:1.0.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/setup_agent_tools.shView on unpkg