registry / AI-agent control-surface risk / trimprompt
trimprompt
TrimPrompt — Save 80% on LLM tokens. Zero-config CLI proxy for AI coding agents
This report shows the evidence for trimprompt@1.0.36. 7 of 7 known versions are blocked or flagged. The newest version, 1.0.49, is blocked. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms an unconsented postinstall mutation of broad shell command control surfaces intended to activate around AI agents. This meets the install-control-surface block boundary.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm postinstall; later shell commands with AI-agent environment variables set
Impact
Unconsented interception of developer/agent command execution and telemetry exfiltration.
Mechanism
postinstall PATH/profile persistence and AI-agent command shimming
Policy narrative
The postinstall hook automatically invokes shim installation. It creates a user-level shim directory, prepends it through shell profile/PATH changes, and installs wrappers for common development commands. In detected AI-agent environments, those wrappers route commands through the package, creating an unconsented broad control point. Separately, runtime tracking can POST developer identity and aggregate activity to a hard-coded Railway endpoint.
AI rationale
Source inspection confirms an unconsented postinstall mutation of broad shell command control surfaces intended to activate around AI agents. This meets the install-control-surface block boundary.
Evidence
package.jsoncli.jsshims.jssync.jsfile-watcher.jshooks/claude-hook.js~/.trimprompt/shims/*~/.bashrc~/.zshrc~/.profile~/.claude/hooks/post_tool_use.js
Network endpoints1
trimp-production.up.railway.app/api/telemetry
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs `node cli.js shims install` in postinstall.
- cli.js dispatches `shims install` to installShims().
- shims.js prepends ~/.trimprompt/shims to shell profiles/PATH automatically.
- shims.js installs wrappers for common commands that invoke `trim` when AI-agent env vars are set.
- sync.js POSTs telemetry to trimp-production.up.railway.app and derives developer identity from git email or OS username.
- file-watcher.js installs a Claude hook and watches/modifies agent session files when invoked.
Evidence against
- No remote payload download or eval-based execution was confirmed.
- Telemetry payload shown in sync.js is aggregate usage metadata, not raw cached content.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystem
HighEntropyStringsMinifiedObfuscated
NoLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node cli.js shims install || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node cli.js shims install || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgsimulate.jsView file
1'use strict';const a0_0x202bb5=a0_0x273e;(function(_0x35015c,_0x107ba1){const _0x4defb2=a0_0x273e,_0x56da66=_0x35015c();while(!![]){try{const _0x285722=parseInt(_0x4defb2(0xa8))/0x...
High
Obfuscated Payload Loader
Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.
simulate.jsView on unpkg · L1Findings
3 High5 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighObfuscated Payload Loadersimulate.js
HighObfuscated
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiresimulate.js
MediumEnvironment Vars
MediumInstall Persistenceshims.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to trimprompt@1.0.36.
The versions list below shows the verdict for each recorded version.
- Avoid installing trimprompt@1.0.36. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.