registry / tokenshield-contextplus / 1.0.2

tokenshield-contextplus@1.0.2

⚠ Under review

AI Coding Token Economizer & Model Fatigue Shield for Cursor, Claude Code, Windsurf & VS Code

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 35.2 KB of source, external domains: praveenojha.com

Source & flagged code

5 flagged

bin/cli.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

3/**

4 * TokenShield & Context++ — Developer CLI

5 * ========================================

6 * Universal AI Coding Token Economizer & Model Fatigue Shield

7 */

9const fs = require('fs');

10const path = require('path');

11const os = require('os');

12const { execSync, spawn } = require('child_process');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L11

14const HOME_DIR = os.homedir();

15const CONFIG_DIR = path.join(HOME_DIR, '.tokenshield');

16const VAULT_FILE = path.join(CONFIG_DIR, 'vault.json');

17const LICENSE_SERVER = process.env.TOKENSHIELD_LICENSE_SERVER || 'https://praveenojha.com/api/store/license/verify';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/cli.jsView on unpkg · L11

19// Ensure config dir exists

20if (!fs.existsSync(CONFIG_DIR)) {

21 fs.mkdirSync(CONFIG_DIR, { recursive: true });

22}

24// Read or init Vault State (50,000 token trial)

25function getVault() {

26 if (fs.existsSync(VAULT_FILE)) {

27 try {

28 return JSON.parse(fs.readFileSync(VAULT_FILE, 'utf8'));

29 } catch (e) {}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/cli.jsView on unpkg · L11

30 }

31 const defaultVault = {

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. alse, islicensed: false }; } return { allowed: true, islicensed: false }; } function findcorescript(scriptname) { const candidates = [ path.join(__dirname, '../core', scriptname), path.join(__dirname, '../../core', scriptname), path.join(__dirname, 'core', scriptname), path.join(__dirname, scriptname), path.join(process.cwd(), 'scripts', scriptname), path.join(__dirname, '../../../scripts', scriptname) ]; for (const p of candidates) { if (fs.existssync(p)) return p; } return null; } function runcorescript(scriptname, args = []) { const scriptpath = findcorescript(scriptname); if (!scriptpath) { console.error(`${c.red}❌ error:

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/cli.jsView on unpkg

core/audio_context_compressor.pyView file

•path = core/audio_context_compressor.py kind = build_helper sizeBytes = 27884 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/audio_context_compressor.pyView on unpkg

Source & flagged code

5 flagged · loading source

bin/cli.jsView file

11const os = require('os'); L12: const { execSync, spawn } = require('child_process'); L13:

tokenshield-contextplus@1.0.2

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code