registry / tokmax / 0.9.15

tokmax@0.9.15

Scan your local Codex + Claude Code logs, aggregate per-model token usage, and publish the API-equivalent $ to the tokmax leaderboard (tokmax.dev). Prices: LiteLLM, counting: ccusage. Aggregates only — never your prompts, files, or keys.

AI Security Review

scanned 19d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a user-invoked token usage leaderboard CLI with expected local log reads, aggregate publishing, optional login, and optional daily scheduler setup.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs npx tokmax, tokmax login, tokmax publish, or tokmax daily on

Impact

Publishes token/count/cost aggregates and optional plan label; no prompt/key/file-content exfiltration found

Mechanism

aggregate local usage and publish numeric totals

Rationale

Static inspection shows risky primitives are package-aligned and user-invoked: local usage aggregation, authenticated publish, browser login, and optional scheduler. No lifecycle execution, hidden payload, credential/file-content exfiltration, destructive behavior, or AI-agent control-surface mutation was found.

Evidence

package.jsonbin/tokmax.mjssrc/adapters/codex.mjssrc/adapters/claude-code.mjssrc/publish.mjssrc/auth.mjssrc/secrets.mjssrc/daily.mjssrc/plan.mjs~/.codex/sessions/**/*.jsonl~/.codex/archived_sessions/*.jsonl~/.claude*/projects/**/*.jsonl~/.claude.json~/.codex/auth.json~/.config/tokenmax/*.json~/.config/tokenmax/daily.log

tokmax@0.9.15

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code