registry / tokenusage-cli / 0.2.3
tokenusage-cli@0.2.3
Self-hosted AI coding token usage collector for the Token Usage dashboard.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package has no install-time hook that performs external actions. Its AI-tool configuration and scheduled collection are initiated by the user's init command, and optional Sentry reporting requires a configured DSN and honors opt-out.
Static reason
No blocking static signals were detected.
Trigger
The user runs the init command; interactive use asks whether to proceed.
Impact
Background usage collection can occur after setup, consistent with the package's stated purpose.
Mechanism
Init can configure AI-tool integrations and register an hourly Windows sync task. Optional Sentry reporting requires a supplied DSN and supports opt-out.
AI rationale
The package has no install-time hook that performs external actions. Its AI-tool configuration and scheduled collection are initiated by the user's init command, and optional Sentry reporting requires a configured DSN and honors opt-out.
Evidence
src/commands/init.jssrc/lib/openclaw-hook.jssrc/lib/scheduled-task.jssrc/lib/usage-limits.jssrc/lib/sentry.js
Network endpoints1
api.github.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only lifecycle script is prepublishOnly, which runs tests; there is no install hook.
- Integration setup and Windows task registration are part of the explicit init command, which prompts before applying changes in interactive use.
- OpenClaw session plugin installation is called from the init integration setup.
- Sentry reporting is disabled unless a DSN is supplied and honors the telemetry opt-out.
Evidence against
- Init can install integrations and register an hourly Windows task, enabling background collection after setup.
- The package reads provider credentials to query provider usage APIs as part of its usage-collection features.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedsrc/lib/claude-categorizer.jsView file
335function defaultClaudeProjectsDir() {
L336: return path.join(os.homedir(), ".claude", "projects");
L337: }
...
L512: try {
L513: obj = JSON.parse(line);
L514: } catch (_e) {
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/lib/claude-categorizer.jsView on unpkg · L335src/lib/scheduled-task.jsView file
7Trigger-reachable persistence chain: manifest.main -> src/cli.js -> src/commands/init.js -> src/lib/scheduled-task.js
L7: // on Interactive tasks), which runs `node <cli.js> sync` fully hidden and
L8: // propagates the exit code via WScript.Quit. The CLI logs to a rolling
L9: // <trackerDir>/logs/sync.log itself (autoLog sink), so the registration no
...
L15: //
L16: // Everything here is best-effort: a missing schtasks or an access error must
L17: // never fail init/pause/resume — the pause flag alone already stops syncs.
L18:
L19: const { execFileSync } = require("node:child_process");
L20: const fs = require("node:fs");
...
L26: function isWindows() {
L27: return process.platform === "win32";
L28: }
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
Findings
3 High3 Medium6 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationsrc/lib/openclaw-hook.js
HighTrigger Reachable Persistencesrc/lib/scheduled-task.js
HighSemantic Analysis Limitedsrc/lib/qoder-limits.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/lib/scheduled-task.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptosrc/lib/claude-categorizer.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to tokenusage-cli@0.2.3.
See all versions of tokenusage-cli for other recorded verdicts.
- Review the evidence and your use of tokenusage-cli@0.2.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.