registry / tokentracker-cli / 0.83.2

tokentracker-cli@0.83.2

Local-first AI coding token usage and cost tracker for 27 tools, with a dashboard, desktop pet, widgets, achievements, and native macOS/Windows apps.

Static Scan Results

scanned 14h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 145 file(s), 4.66 MB of source, external domains: 1.1.1.1, 127.0.0.1, 2026.ip138.com, api.anthropic.com, api.github.com, api.kimi.com, api.openai.com, api.z.ai, auth.kimi.com, auth.openai.com, bigmodel.cn, chatgpt.com, claude.ai, cli-chat-proxy.grok.com, cloudcode-pa.googleapis.com, codex-pets.net, cursor.com, fonts.googleapis.com, github.com, gsap.com, ip.net.coffee, jcgt.org, local.tokentracker, my.ip.cn, oauth2.googleapis.com, open.er-api.com, opencode.ai, raw.githubusercontent.com, reactjs.org, skills.sh, srctyff5.us-east.insforge.app, tokentracker.statuspage.io, twitter.com, va.vercel-scripts.com, vercel.com, www.cursor.com, www.tokentracker.cc, www.w3.org, yandex.com, zcode.z.ai

Source & flagged code

9 flagged

dashboard/dist/assets/DevicePage-Cf-PHRlL.jsView file

Lines 1-2javascript

1import{a as p,r as c,j as e,h as b}from"./__vite-browser-external-DWKjPxnU.js";const f={BASE_URL:"/",DEV:!1,MODE:"production",PROD:!0,SSR:!1,VITE_APP_VERSION:"0.83.2",VITE_INSFORGE_ANON_KEY:"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3OC0xMjM0LTU2NzgtOTBhYi1jZGVmMTIzNDU2NzgiLCJlbWFpbCI6ImFub25AaW5zZm9yZ2UuY29tIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODExNDU5NDd9.T0auta_IrVIh0uXW1bob5QSnzvsnJmN28r5XkSGEuQY",VITE_INSFORGE_BASE_URL:"https://srctyff5.us-east.insforge.app"};function x(){return b(),`${(f&&"https://srctyff5.us-east.insforge.app"||"https://srctyff5.us-east.insforge.app").replace(/ ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dashboard/dist/assets/DevicePage-Cf-PHRlL.jsView on unpkg · L1

Critical

Secret Pattern

Supabase service role key (JWT) in dashboard/dist/assets/DevicePage-Cf-PHRlL.js

dashboard/dist/assets/DevicePage-Cf-PHRlL.jsView on unpkg · L1

Long lines were clipped for display.

src/lib/claude-categorizer.jsView file

Lines 314-354javascript

314 total_calls: [...toolCallCounts.values()].reduce((a, b) => a + b, 0),

315 by_name: new Map(

src/lib/proxy-env.jsView file

Lines 86-126javascript

86}

88// Node's built-in NODE_USE_ENV_PROXY support only landed in v22.21 / v24.5.

89// For older runtimes (including the v22.14 we historically embedded in the

90// macOS app, and the v22.16 a community user hit on Discussion #68) the env

91// var is silently ignored and fetch() bypasses the proxy. Setting an undici

92// ProxyAgent dispatcher at startup gives us proxy support on every Node ≥ 18

93// regardless of the env-proxy flag.

94function applyUndiciProxyIfNeeded({

dashboard/dist/assets/geist-mono-latin-ext-900-normal-DvYIGD1f.woff2View file

•path = dashboard/dist/assets/geist-mono-latin-ext-900-normal-DvYIGD1f.woff2 kind = high_entropy_blob sizeBytes = 7164 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dashboard/dist/assets/geist-mono-latin-ext-900-normal-DvYIGD1f.woff2View on unpkg

src/commands/serve.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = tokentracker-cli@0.81.1 matchedIdentity = npm:dG9rZW50cmFja2VyLWNsaQ:0.81.1 similarity = 0.533 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/serve.jsView on unpkg

dashboard/dist/assets/__vite-browser-external-DWKjPxnU.jsView file

44patternName = supabase_service_key severity = critical line = 44 matchedText = `);o=h.p...atus

Critical

Secret Pattern

Supabase service role key (JWT) in dashboard/dist/assets/__vite-browser-external-DWKjPxnU.js

dashboard/dist/assets/__vite-browser-external-DWKjPxnU.jsView on unpkg · L44

src/lib/cursor-config.jsView file

Lines 55-95javascript

56function readCursorAccessTokenFromStateDb(stateDbPath, deps = {}) {

57 return readSqliteFirstValue(stateDbPath, CURSOR_ACCESS_TOKEN_SQL, "value", {

58 execFileSync: deps.execFileSync,

59 requireFn: deps.requireFn,

src/lib/runtime-config.jsView file

Lines 1-31javascript

1const DEFAULT_BASE_URL = "https://srctyff5.us-east.insforge.app";

2const DEFAULT_DASHBOARD_URL = "https://www.tokentracker.cc";

3const DEFAULT_HTTP_TIMEOUT_MS = 20_000;

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code