registry / @tokz/cli / 0.2.24

@tokz/cli@0.2.24

See where your coding agents' tokens and dollars actually go.

AI Security Review

scanned 22h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `tokz statusline enable`; Claude Code subsequently renders its status line.

Impact

Persists a package command in the user's Claude Code settings until disabled.

Mechanism

Explicit Claude Code statusLine configuration write

Rationale

This is an explicit user-command AI-agent configuration mutation, not concrete malicious behavior. Apply a warning under the stated policy rather than a block.

Evidence

package.jsondist/cli.jsdist/statusline-ES3W3TEU.jsdist/chunk-YVDSYDGL.jsdist/chunk-65BQE6TI.jsdist/Root-TSFGS7DV.js~/.claude/settings.json~/.tokz/litellm-prices.json~/.claude/projects~/.claude.json.mcp.json

Network endpoints1

raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json

@tokz/cli@0.2.24

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code