registry / tokentracker-cli / 0.68.1

tokentracker-cli@0.68.1

Token usage tracker for AI agent CLIs (Claude Code, Codex, Cursor, Gemini, Antigravity, Kiro, OpenCode, OpenClaw, Every Code, Hermes, GitHub Copilot, Kimi Code, CodeBuddy, WorkBuddy, Grok Build, oh-my-pi, pi, Craft Agents, Kilo CLI, Kilo Code, Roo Code, Z

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 99 file(s), 3.67 MB of source, external domains: 1.1.1.1, 127.0.0.1, 2026.ip138.com, api.anthropic.com, api.github.com, api.kimi.com, api.openai.com, auth.kimi.com, auth.openai.com, chatgpt.com, claude.ai, cli-chat-proxy.grok.com, cloudcode-pa.googleapis.com, cursor.com, fonts.googleapis.com, github.com, ip.net.coffee, jcgt.org, local.tokentracker, my.ip.cn, oauth2.googleapis.com, open.er-api.com, opencode.ai, raw.githubusercontent.com, reactjs.org, skills.sh, socket.io, srctyff5.us-east.insforge.app, tokentracker.statuspage.io, twitter.com, va.vercel-scripts.com, vercel.com, www.cursor.com, www.tokentracker.cc, www.w3.org, zcode.z.ai

Source & flagged code

9 flagged

dashboard/dist/assets/main-BS4wXJQk.jsView file

42patternName = supabase_service_key severity = critical line = 42 matchedText = `);i=d.p...atus

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dashboard/dist/assets/main-BS4wXJQk.jsView on unpkg · L42

42patternName = supabase_service_key severity = critical line = 42 matchedText = `);i=d.p...atus

Critical

Secret Pattern

Supabase service role key (JWT) in dashboard/dist/assets/main-BS4wXJQk.js

dashboard/dist/assets/main-BS4wXJQk.jsView on unpkg · L42

src/lib/claude-categorizer.jsView file

Lines 314-354javascript

314 total_calls: [...toolCallCounts.values()].reduce((a, b) => a + b, 0),

315 by_name: new Map(

316 [...toolCallCounts.entries()].map(([name, calls]) => [

317 name,

318 { name, calls, output_tokens: toolTokensByName.get(name) || 0 },

319 ]),

320 ),

321 },

322 subagents: {

323 total_calls: [...subagentCounts.values()].reduce((a, b) => a + b, 0),

324 by_name: new Map(

325 [...subagentCounts.entries()].map(([name, calls]) => [

326 name,

327 { name, calls, output_tokens: subagentTokensByName.get(name) || 0 },

328 ]),

329 ),

330 },

331 };

332}

333

334function defaultClaudeProjectsDir() {

335 return path.join(os.homedir(), ".claude", "projects");

336}

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/lib/claude-categorizer.jsView on unpkg · L334

337

338function listSessionFiles(rootDir) {

339 const out = [];

340 const stack = [rootDir];

341 while (stack.length > 0) {

342 const dir = stack.pop();

343 let entries;

344 try {

345 entries = fssync.readdirSync(dir, { withFileTypes: true });

346 } catch (_e) {

347 continue;

348 }

349 for (const entry of entries) {

350 const fp = path.join(dir, entry.name);

351 if (entry.isDirectory()) {

352 stack.push(fp);

353 } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {

354 out.push(fp);

src/lib/proxy-env.jsView file

Lines 86-126javascript

86}

88// Node's built-in NODE_USE_ENV_PROXY support only landed in v22.21 / v24.5.

89// For older runtimes (including the v22.14 we historically embedded in the

90// macOS app, and the v22.16 a community user hit on Discussion #68) the env

91// var is silently ignored and fetch() bypasses the proxy. Setting an undici

92// ProxyAgent dispatcher at startup gives us proxy support on every Node ≥ 18

93// regardless of the env-proxy flag.

94function applyUndiciProxyIfNeeded({

95 env =

dashboard/dist/assets/geist-mono-latin-ext-900-normal-DvYIGD1f.woff2View file

•path = dashboard/dist/assets/geist-mono-latin-ext-900-normal-DvYIGD1f.woff2 kind = high_entropy_blob sizeBytes = 7164 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dashboard/dist/assets/geist-mono-latin-ext-900-normal-DvYIGD1f.woff2View on unpkg

src/commands/serve.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = tokentracker-cli@0.68.0 matchedIdentity = npm:dG9rZW50cmFja2VyLWNsaQ:0.68.0 similarity = 0.980 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/serve.jsView on unpkg

dashboard/dist/assets/DevicePage-BGkZILd3.jsView file

Lines 1-2javascript

1import{Y as p,r as c,j as e,aO as b}from"./main-BS4wXJQk.js";const f={BASE_URL:"/",DEV:!1,MODE:"production",PROD:!0,SSR:!1,VITE_APP_VERSION:"0.68.1",VITE_INSFORGE_ANON_KEY:"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3OC0xMjM0LTU2NzgtOTBhYi1jZGVmMTIzNDU2NzgiLCJlbWFpbCI6ImFub25AaW5zZm9yZ2UuY29tIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODExNDU5NDd9.T0auta_IrVIh0uXW1bob5QSnzvsnJmN28r5XkSGEuQY",VITE_INSFORGE_BASE_URL:

src/lib/cursor-config.jsView file

Lines 55-95javascript

56function readCursorAccessTokenFromStateDb(stateDbPath, deps = {}) {

57 return readSqliteFirstValue(stateDbPath, CURSOR_ACCESS_TOKEN_SQL, "value", {

58 execFileSync: deps.execFileSync,

59 requireFn: deps.requireFn,

60 env: deps.env,

61 stderr: deps.stderr,

src/lib/runtime-config.jsView file

Lines 1-31javascript

1const DEFAULT_BASE_URL = "https://srctyff5.us-east.insforge.app";

2const DEFAULT_DASHBOARD_URL = "https://www.tokentracker.cc";

3const DEFAULT_HTTP_TIMEOUT_MS = 20_000;

4// Public InsForge anon key (JWT, role=anon). Mirrors dashboard/src/lib/insforge-config.ts

5// (PROD_INSFORGE_ANON_KEY) — public by design (ships in the browser bundle and

6// appears in .github/workflows/*.yml). The local server needs it to call the

Source & flagged code

9 flagged · loading source

dashboard/dist/assets/main-BS4wXJQk.jsView file

42patternName = supabase_service_key severity = critical line = 42 matchedText = `);i=d.p...atus

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dashboard/dist/assets/main-BS4wXJQk.jsView on unpkg · L42

42patternName = supabase_service_key severity = critical line = 42 matchedText = `);i=d.p...atus

Critical

Secret Pattern

Supabase service role key (JWT) in dashboard/dist/assets/main-BS4wXJQk.js

dashboard/dist/assets/main-BS4wXJQk.jsView on unpkg · L42

src/lib/claude-categorizer.jsView file

334function defaultClaudeProjectsDir() { L335: return path.join(os.homedir(), ".claude", "projects"); L336: } ... L511: try { L512: obj = JSON.parse(line); L513: } catch (_e) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/lib/claude-categorizer.jsView on unpkg · L334

src/lib/proxy-env.jsView file

106package = tokentracker-cli; repositoryIdentity = tokentracker; dependency = undici L106: // eslint-disable-next-line global-require L107: const undici = require("undici"); L108: setter = setter || undici.setGlobalDispatcher;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/lib/proxy-env.jsView on unpkg · L106

dashboard/dist/assets/geist-mono-latin-ext-900-normal-DvYIGD1f.woff2View file

•path = dashboard/dist/assets/geist-mono-latin-ext-900-normal-DvYIGD1f.woff2 kind = high_entropy_blob sizeBytes = 7164 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dashboard/dist/assets/geist-mono-latin-ext-900-normal-DvYIGD1f.woff2View on unpkg

src/commands/serve.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/serve.jsView on unpkg

dashboard/dist/assets/DevicePage-BGkZILd3.jsView file

1patternName = supabase_service_key severity = critical line = 1 matchedText = import{Y...lt};

Critical

Secret Pattern

Supabase service role key (JWT) in dashboard/dist/assets/DevicePage-BGkZILd3.js

dashboard/dist/assets/DevicePage-BGkZILd3.jsView on unpkg · L1

src/lib/cursor-config.jsView file

75patternName = generic_password severity = medium line = 75 matchedText = * - na...XXX"

Medium

Secret Pattern

Hardcoded password in src/lib/cursor-config.js

src/lib/cursor-config.jsView on unpkg · L75

src/lib/runtime-config.jsView file

11patternName = supabase_service_key severity = critical line = 11 matchedText = "eyJhbGc...QY";

Critical

Secret Pattern

Supabase service role key (JWT) in src/lib/runtime-config.js

src/lib/runtime-config.jsView on unpkg · L11

Findings

4 Critical3 High4 Medium6 Low

CriticalCritical Secretdashboard/dist/assets/main-BS4wXJQk.js

CriticalSecret Patterndashboard/dist/assets/main-BS4wXJQk.js

CriticalSecret Patterndashboard/dist/assets/DevicePage-BGkZILd3.js

CriticalSecret Patternsrc/lib/runtime-config.js

HighCopied Package Dependency Bridgesrc/lib/proxy-env.js

HighShips High Entropy Blobdashboard/dist/assets/geist-mono-latin-ext-900-normal-DvYIGD1f.woff2

HighPrevious Version Dangerous Deltasrc/commands/serve.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternsrc/lib/cursor-config.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptosrc/lib/claude-categorizer.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

dashboard/dist/assets/main-BS4wXJQk.jsView file

42patternName = supabase_service_key severity = critical line = 42 matchedText = `);i=d.p...atus

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dashboard/dist/assets/main-BS4wXJQk.jsView on unpkg · L42

42patternName = supabase_service_key severity = critical line = 42 matchedText = `);i=d.p...atus

Critical

Secret Pattern

Supabase service role key (JWT) in dashboard/dist/assets/main-BS4wXJQk.js

dashboard/dist/assets/main-BS4wXJQk.jsView on unpkg · L42

src/lib/claude-categorizer.jsView file

Lines 314-354javascript

314 total_calls: [...toolCallCounts.values()].reduce((a, b) => a + b, 0),

315 by_name: new Map(

316 [...toolCallCounts.entries()].map(([name, calls]) => [

317 name,

318 { name, calls, output_tokens: toolTokensByName.get(name) || 0 },

319 ]),

320 ),

321 },

322 subagents: {

323 total_calls: [...subagentCounts.values()].reduce((a, b) => a + b, 0),

324 by_name: new Map(

325 [...subagentCounts.entries()].map(([name, calls]) => [

326 name,

327 { name, calls, output_tokens: subagentTokensByName.get(name) || 0 },

328 ]),

329 ),

330 },

331 };

332}

333

334function defaultClaudeProjectsDir() {

335 return path.join(os.homedir(), ".claude", "projects");

336}

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/lib/claude-categorizer.jsView on unpkg · L334

337

338function listSessionFiles(rootDir) {

339 const out = [];

340 const stack = [rootDir];

341 while (stack.length > 0) {

342 const dir = stack.pop();

343 let entries;

344 try {

345 entries = fssync.readdirSync(dir, { withFileTypes: true });

346 } catch (_e) {

347 continue;

348 }

349 for (const entry of entries) {

350 const fp = path.join(dir, entry.name);

351 if (entry.isDirectory()) {

352 stack.push(fp);

353 } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {

354 out.push(fp);

src/lib/proxy-env.jsView file

Lines 86-126javascript

86}

88// Node's built-in NODE_USE_ENV_PROXY support only landed in v22.21 / v24.5.

89// For older runtimes (including the v22.14 we historically embedded in the

90// macOS app, and the v22.16 a community user hit on Discussion #68) the env

91// var is silently ignored and fetch() bypasses the proxy. Setting an undici

92// ProxyAgent dispatcher at startup gives us proxy support on every Node ≥ 18

93// regardless of the env-proxy flag.

94function applyUndiciProxyIfNeeded({

95 env =

dashboard/dist/assets/geist-mono-latin-ext-900-normal-DvYIGD1f.woff2View file

•path = dashboard/dist/assets/geist-mono-latin-ext-900-normal-DvYIGD1f.woff2 kind = high_entropy_blob sizeBytes = 7164 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dashboard/dist/assets/geist-mono-latin-ext-900-normal-DvYIGD1f.woff2View on unpkg

src/commands/serve.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/serve.jsView on unpkg

dashboard/dist/assets/DevicePage-BGkZILd3.jsView file

Lines 1-2javascript

src/lib/cursor-config.jsView file

Lines 55-95javascript

56function readCursorAccessTokenFromStateDb(stateDbPath, deps = {}) {

57 return readSqliteFirstValue(stateDbPath, CURSOR_ACCESS_TOKEN_SQL, "value", {

58 execFileSync: deps.execFileSync,

59 requireFn: deps.requireFn,

60 env: deps.env,

61 stderr: deps.stderr,

src/lib/runtime-config.jsView file

Lines 1-31javascript

1const DEFAULT_BASE_URL = "https://srctyff5.us-east.insforge.app";

2const DEFAULT_DASHBOARD_URL = "https://www.tokentracker.cc";

3const DEFAULT_HTTP_TIMEOUT_MS = 20_000;

4// Public InsForge anon key (JWT, role=anon). Mirrors dashboard/src/lib/insforge-config.ts

5// (PROD_INSFORGE_ANON_KEY) — public by design (ships in the browser bundle and

6// appears in .github/workflows/*.yml). The local server needs it to call the