registry  /  tktuner  /  0.2.1

tktuner@0.2.1

Local-first token usage analytics and cost optimization for Claude Code power users. Stop paying Fable prices for Haiku work.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 90.0 KB of source, external domains: github.com, platform.claude.com, tktuner.com

Source & flagged code

2 flagged · loading source
dist/cli.jsView file
5L6: // package.json L7: var package_default = { ... L42: type: "git", L43: url: "https://github.[redacted].git" L44: }, ... L64: // src/cli/login.ts L65: import { spawn } from "child_process"; L66: import { hostname, userInfo } from "os"; ... L88: headers["content-encoding"] = "gzip"; L89: body = gzipSync(Buffer.from(raw, "utf8")); L90: } else {
High
Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/cli.jsView on unpkg · L5
5L6: // package.json L7: var package_default = { ... L42: type: "git", L43: url: "https://github.[redacted].git" L44: }, ... L64: // src/cli/login.ts L65: import { spawn } from "child_process"; L66: import { hostname, userInfo } from "os"; ... L88: headers["content-encoding"] = "gzip"; L89: body = gzipSync(Buffer.from(raw, "utf8")); L90: } else {
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L5

Findings

2 High3 Medium4 Low
HighHost Fingerprint Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings