Supply Chain TokenSaver CLI Agent Token Interception

How the attack works

A developer installs TokenSaver CLI as a dependency, believing it helps manage or optimize AI agent usage. The package rewrites the network settings of AI coding tools so their outbound traffic, including authentication tokens, is sent through a third-party gateway instead of going directly to the real service. That gateway logs the intercepted credentials. Whoever controls the gateway can then replay the stolen tokens to impersonate the developer's AI agent sessions and access whatever services those tokens permit.

Netzilo detection

Why it matters

An attacker can hijack a developer's AI coding assistant session and reuse stolen API keys to access Anthropic, OpenAI, or other connected services under the victim's identity, potentially reaching source code, internal systems, or paid API quota.

What you can do

• →Audit installed Python packages for TokenSaver CLI or similarly named 'AI agent routing' or 'control plane' dependencies and remove them if not explicitly approved.
• →Check whether ANTHROPIC_BASE_URL, OPENAI_BASE_URL, or equivalent proxy settings for Claude Code, Cursor, or Codex have been silently changed to an unfamiliar host.
• →Rotate any AI provider API keys or credential files that may have transited an unapproved proxy.
• →Restrict which internal systems and CI jobs are allowed to install new third-party packages that touch AI agent configuration, and review new dependencies before merge.

Known benign look-alikes

• Security researcher or SOC analyst pulling the TokenSaver package page, release artefacts or a vendor advisory while triaging the dependency — normally caught by filter_pkg_metadata / filter_security_research, but a rendered page that quotes a realistic-looking token can still slip through.
• An internal AI egress gateway that legitimately proxies Claude Code / Cursor / Codex traffic and happens to ship a similarly-named product, header or JSON key. Confirm the destination host is the approved corporate gateway before escalating.
• CI/CD or dotfile-sync jobs POSTing an environment template that sets ANTHROPIC_BASE_URL / OPENAI_BASE_URL to a real internal URL alongside a real key.
• Developer telemetry or crash reporters that upload a redacted config blob which still contains the literal credential file paths (.claude/.credentials.json, .codex/auth.json).

References

• https://attack.mitre.org/techniques/T1552/001/
• https://attack.mitre.org/techniques/T1195/001/
• https://atlas.mitre.org/techniques/AML.T0010
• https://owasp.org/www-project-top-10-for-large-language-model-applications/

Related threats