Loading npm security reports…

tokenmaxx@0.0.16: Suspicious npm security report (Warn) | LPM Firewall

registry / tokenmaxx / 0.0.16

tokenmaxx@0.0.16

A local proxy that juggles rate limits across your Codex and Claude Code accounts — with live token-throughput analytics.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

Manifest

WildcardDependency

scanned 2 file(s), 745 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.openai.com, auth.openai.com, bun.sh, chatgpt.com, github.com, json-schema.org, registry.npmjs.org, tokenmaxx.sh

Source & flagged code

3 flagged

dist/index.jsView file

16700init_zod(); L16701: import { spawn } from "child_process"; L16702: import { closeSync, openSync } from "fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L16700

dist/launcher.cjsView file

Lines 1-29javascript

1#!/usr/bin/env node

2'use strict'

4// tokenmaxx runs on the Bun runtime (bun:sqlite, Bun.TOML, Bun.spawn, …), but it

5// should install cleanly with any package manager. npm/pnpm/yarn create a shim

6// that runs this file with node; `bun add -g` runs it with bun. Either way this

7// launcher finds a Bun binary and hands the real bundle to it, so the published

8// `#!/usr/bin/env bun` shebang never has to resolve on the caller's PATH.

10const { spawnSync } = require('node:child_process')

11const { existsSync } = require('node:fs')

12const { join } = require('node:path')

13const { homedir } = require('node:os')

15const bundle = join(__dirname, 'index.js')

16const isWindows = process.platform === 'win32'

17const bunName = isWindows ? 'bun.exe' : 'bun'

19function findBun() {

20 // Already running under Bun (the `bun add -g` shim) — reuse this very runtime.

21 if (process.versions.bun) {

22 return process.execPath

23 }

24 const candidates = []

25 if (process.env.BUN_INSTALL) {

26 candidates.push(join(process.env.BUN_INSTALL, 'bin', bunName))

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/launcher.cjsView on unpkg · L9

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/launcher.cjsView on unpkg · L9

27 }

28 candidates.push(join(homedir(), '.bun', 'bin', bunName))

29 if (!isWindows) {

Source & flagged code

3 flagged · loading source

dist/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code