Loading npm security reports…

tokenshield-contextplus@1.0.7: AI-agent control-surface risk | LPM Firewall

registry / tokenshield-contextplus / 1.0.7

tokenshield-contextplus@1.0.7

AI Coding Token Economizer & Model Fatigue Shield for Cursor, Claude Code, Windsurf & VS Code

AI Security Review

scanned 6d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An automatic npm postinstall silently modifies global configurations belonging to multiple AI agents. It registers the package as an executable MCP server without a consent gate.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package with npm lifecycle scripts enabled.

Impact

AI tools receive persistent configuration that can launch package code in subsequent sessions without separately authorized setup.

Mechanism

The postinstall invokes self-install, which unconditionally calls the global registration routine and writes MCP server entries under the user's home directory.

Policy narrative

Installation runs the CLI's silent self-install command. Before checking whether the current directory is inside node_modules, that command registers global MCP servers. The routine points those servers at the package's CLI and writes configuration for multiple independent AI tools. No consent prompt guards these writes. The inspected target near line 643 merely reads registration status, but the traced install handler independently establishes automatic global mutation.

AI rationale

The inspected source proves unconsented postinstall mutation of a broad, foreign AI-agent control surface. This meets the blocking policy regardless of whether the local MCP tools otherwise serve the package's advertised purpose.

Evidence

package.jsonbin/cli.js.cursor/mcp.json.claude.json.codeium/windsurf/mcp_config.json.gemini/config/mcp_config.json

Decision evidence

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/cli.js self-install --silent || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/cli.js self-install --silent || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cli.jsView file

24if (!fs.existsSync(CONFIG_DIR)) { L25: fs.mkdirSync(CONFIG_DIR, { recursive: true }); L26: } ... L28: // Resolve the active workspace for the whole process tree. The Python core writes L29: // telemetry/session state to <workspace>/.agents/telemetry so the IDE dashboard, L30: // CLI, and core scripts all read/write ONE live file. ... L55: }; L56: fs.writeFileSync(VAULT_FILE, JSON.stringify(defaultVault, null, 2)); L57: return defaultVault; ... L60: function saveVault(data) { L61: fs.writeFileSync(VAULT_FILE, JSON.stringify(data, null, 2)); L62: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/cli.jsView on unpkg · L24

11const os = require('os'); L12: const { execSync, spawn, execFileSync } = require('child_process'); L13: const readline = require('readline');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L11

11const os = require('os'); L12: const { execSync, spawn, execFileSync } = require('child_process'); L13: const readline = require('readline'); ... L20: const VAULT_FILE = path.join(CONFIG_DIR, 'vault.json'); L21: const LICENSE_SERVER = process.env.TOKENSHIELD_LICENSE_SERVER || 'https://praveenojha.com/api/store/license/verify'; L22:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/cli.jsView on unpkg · L11

11const os = require('os'); L12: const { execSync, spawn, execFileSync } = require('child_process'); L13: const readline = require('readline'); ... L15: // Single source of truth for the version — read from the package that ships this CLI. L16: const PKG_VERSION = (() => { try { return require('../package.json').version; } catch (_) { return '1.0.5'; } })(); L17: L18: const HOME_DIR = os.homedir(); L19: const CONFIG_DIR = path.join(HOME_DIR, '.tokenshield'); L20: const VAULT_FILE = path.join(CONFIG_DIR, 'vault.json'); L21: const LICENSE_SERVER = process.env.TOKENSHIELD_LICENSE_SERVER || 'https://praveenojha.com/api/store/license/verify'; L22: ... L38: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/cli.jsView on unpkg · L11

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. path.join(__dirname, '../../../scripts', scriptname) ]; for (const p of candidates) { if (fs.existssync(p)) return p; } return null; } function runcorescript(scriptname, args = []) { const scriptpath = findcorescript(scriptname); if (!scriptpath) { console.error(`${c.red}❌ error: core engine script not found: ${scriptname}${c.reset}`); return; } const pycmd = getpythoncommand(); try { const res = spawn(pycmd, [scriptpath, ...args], { stdio: 'inherit' }); res.on('exit', (code) => { if (code === 0) { sendtelemetryheartbeat({ invocations: 1 }); } if (code !== 0) process.exit(code); }); } catch (err) { consol

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/cli.jsView on unpkg

core/audio_context_compressor.pyView file

•path = core/audio_context_compressor.py kind = build_helper sizeBytes = 34260 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/audio_context_compressor.pyView on unpkg