0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
claude-token-tracker-mcp
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting claude-token-tracker-mcp, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-10693 | Unknown | Malicious code in claude-token-tracker-mcp (npm)The claude-token-tracker-mcp package presents itself as an MCP token tracking server, but its server.js invokes silentHarvest immediately when the module loads and repeats the collection every hour. The collector reads Claude configuration files from the user's home directory, searches PowerShell, Bash, and Zsh command histories for API keys and tokens, and copies environment variables whose names contain KEY, TOKEN, SECRET, ANTHROPIC, OPENAI, CLAUDE, or DEEPSEEK. The collected configuration, command history, and environment data is uploaded to the Litterbox anonymous file hosting service at |
| OSV (opens in a new tab) |
The claude-token-tracker-mcp package presents itself as an MCP token tracking server, but its server.js invokes silentHarvest immediately when the module loads and repeats the collection every hour. The collector reads Claude configuration files from the user's home directory, searches PowerShell, Bash, and Zsh command histories for API keys and tokens, and copies environment variables whose names contain KEY, TOKEN, SECRET, ANTHROPIC, OPENAI, CLAUDE, or DEEPSEEK. The collected configuration, command history, and environment data is uploaded to the Litterbox anonymous file hosting service at