tokenusage-cli@0.1.0
Self-hosted AI coding token usage collector for token-usage (forked from TokenTracker, MIT).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe default sync flow sends runtime telemetry that the README does not disclose, making the package suspicious under the telemetry rules. The payload is limited to a machine hash and runtime metadata, and users can opt out, so this warrants a warning rather than a publish block.
Static reason
No blocking static signals were detected.
Trigger
A sync reaches its heartbeat call; the request is throttled to at most once per day and can be disabled by configuration or environment variables.
Impact
The service can count active installs and their runtime platforms. The README does not disclose this heartbeat, so it presents a warning-level privacy concern.
Mechanism
The CLI POSTs a machine-ID hash, version, platform, and shell to its tokenusage-telemetry function.
AI rationale
The default sync flow sends runtime telemetry that the README does not disclose, making the package suspicious under the telemetry rules. The payload is limited to a machine hash and runtime metadata, and users can opt out, so this warrants a warning rather than a publish block.
Evidence
src/commands/sync.jssrc/lib/telemetry.jssrc/lib/function-url.jssrc/lib/runtime-config.jsREADME.md~/.tokenusage/config.json~/.tokenusage/telemetry.heartbeat.json~/.tokenusage/queue.jsonl
Network endpoints1
token-usage.baiwumm.com/api/functions/tokenusage-telemetry
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Sync invokes a heartbeat; its comment says it is throttled to one network request per day.
- The heartbeat payload contains a hashed machine ID, package version, platform, and shell.
- It POSTs that payload to the tokenusage-telemetry function on the package’s default service.
- The README describes uploads as aggregated usage and session metadata but does not disclose this heartbeat.
Evidence against
- The heartbeat omits raw machine IDs, credentials, token counts, usernames, and paths.
- Users can disable telemetry with environment variables or telemetry:false in config.
- The package’s stated purpose includes syncing usage data to its service.
- Claude OAuth tokens are sent to Anthropic’s own usage endpoint.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedsrc/lib/claude-categorizer.jsView file
335function defaultClaudeProjectsDir() {
L336: return path.join(os.homedir(), ".claude", "projects");
L337: }
...
L512: try {
L513: obj = JSON.parse(line);
L514: } catch (_e) {
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/lib/claude-categorizer.jsView on unpkg · L335src/lib/openclaw-hook.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
const os = require("node:os");
const path = require("node:path");
const fs = require("node:fs/promises");
const fssync = require("node:fs");
const { runopenclawcli } = require("./openclaw-cli");
const openclaw_hook_name = "tokenusage-openclaw-sync";
const openclaw_hook_dirname = "openclaw-hook";
function resolveopenclawhookpaths({ home = os.homedir(), trackerdir, env = process.env } = {}) {
if (!trackerdir) throw new error("trackerdir is required");
const openclawconfigpath =
normalizestring(env.openclaw_config_path) || path.join(home, ".openclaw", "openclaw.json");
const openclawhome =
normalizestring(env.tokenusage_openclaw_home) ||
norma
High
Trigger Reachable External Ai Agent Control Surface Mutation
Findings
2 High4 Medium6 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationsrc/lib/openclaw-hook.js
HighSemantic Analysis Limitedsrc/lib/qoder-limits.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencesrc/commands/sync.js
MediumAi Review Evidencesrc/commands/sync.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptosrc/lib/claude-categorizer.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to tokenusage-cli@0.1.0.
See all versions of tokenusage-cli for other recorded verdicts.
- Review the evidence and your use of tokenusage-cli@0.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.