registry / tokmon / 0.20.6

tokmon@0.20.6

⚠ Under review

Terminal + web dashboard for Claude Code, Codex, Cursor, opencode, pi, Copilot, Gemini & more — usage, limits, and costs

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 1.28 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.openai.com, api2.cursor.sh, chatgpt.com, cloudcode-pa.googleapis.com, cursor.com, daily-cloudcode-pa.googleapis.com, davidilie.com, fb.me, github.com, nuqs.dev, oauth2.googleapis.com, reactjs.org, www.w3.org

Source & flagged code

5 flagged

dist/web/assets/index-B9eW55YB.jsView file

83`)}const bO=CO();function _O(e){let t=e.message;if(e.path&&e.path.length>0){const n=zN(e.path);t+=` L84: at ${n}`}return t}function pl(e){switch(e._tag){case"InvalidType":case"OneOf":case"Composite":case"AnyOf":return Ea(e.ast.annotations);case"InvalidValue":case"Forbidden":return Ea(... L85: * table-core

High

Eval

Package source references dynamic code evaluation.

dist/web/assets/index-B9eW55YB.jsView on unpkg · L83

dist/chunk-E6YT66ST.jsView file

Lines 266-306javascript

266 return import.meta.url.includes("/src/");

267}

268function findWebSource() {

269 for (const rel of ["../../web/", "../web/", "./web/"]) {

270 try {

271 const dir = fileURLToPath2(new URL(rel, import.meta.url));

272 if (existsSync2(join2(dir, "vite.config.ts")) && existsSync2(join2(dir, "index.html"))) {

273 return dir.replace(/[\\/]+$/, "");

274 }

275 } catch {

276 }

277 }

278 return null;

279}

280async function createViteDevServer(httpServer, log) {

281 const root = findWebSource();

282 if (!root) {

283 log(" \u26A0 dev mode: web/ source not found");

284 return null;

285 }

286 try {

287 const req = createRequire(pathToFileURL(join2(root, "package.json")).href);

288 const vitePath = req.resolve("vite");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-E6YT66ST.jsView on unpkg · L286

289 const vite = await import(pathToFileURL(vitePath).href);

290 const dev = await vite.createServer({

291 root,

292 configFile: join2(root, "vite.config.ts"),

293 server: { middlewareMode: true, hmr: { server: httpServer } },

294 appType: "spa",

295 clearScreen: false,

296 logLevel: "warn"

297 });

298 log(" \u25C6 dev mode \u2014 Vite HMR attached (edit web/src and it hot-reloads)");

299 return dev;

300 } catch (e) {

301 log(` \u26A0 couldn't start Vite dev server: ${e.message}`);

302 log(" run `pnpm --prefix web install` (or `npm run web:install`) for HMR, or `npm run build` for a static bundle");

303 return null;

304 }

305}

306var MISSING_BUILD_HTML = `<!doctype html><html><head><meta charset="utf-8"><title>tokmon web</title>

dist/chunk-YWJT3OG4.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import {

3 PROVIDER_IDS,

4 cacheDir,

5 envDir,

6 expandHome,

7 isValidTimezone,

8 slugify

9} from "./chunk-XQEJ4WQ5.js";

11// src/providers/usage-core.ts

12import

dist/web/assets/jetbrains-mono-latin-ext-400-normal-fXTG6kC5.woffView file

•path = dist/web/assets/jetbrains-mono-latin-ext-400-normal-fXTG6kC5.woff kind = high_entropy_blob sizeBytes = 10128 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/assets/jetbrains-mono-latin-ext-400-normal-fXTG6kC5.woffView on unpkg

Source & flagged code

5 flagged · loading source

dist/web/assets/index-B9eW55YB.jsView file

High

Eval

Package source references dynamic code evaluation.

dist/web/assets/index-B9eW55YB.jsView on unpkg · L83

dist/chunk-E6YT66ST.jsView file

286try { L287: const req = createRequire(pathToFileURL(join2(root, "package.json")).href); L288: const vitePath = req.resolve("vite");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-E6YT66ST.jsView on unpkg · L286

dist/chunk-YWJT3OG4.jsView file

17try { L18: return Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC"; L19: } catch { ... L193: try { L194: const obj = JSON.parse(await readFile(cacheFile(), "utf-8")); L195: for (const [path, s] of Object.entries(obj)) { ... L527: // src/providers/cursor/sqlite.ts L528: import { execFile as execFileCb } from "child_process"; L529: import { accessSync, constants } from "fs"; ... L586: const names = process.platform === "win32" ? ["sqlite3.exe", "sqlite3.cmd", "sqlite3.bat"] : ["sqlite3"]; L587: for (const dir of (process.env.PATH ?? "").split(delimiter).filter(Boolean)) { L588: for (const name of names) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-YWJT3OG4.jsView on unpkg · L17

17Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/bootstrap-ink-WWSVQO6D.js -> dist/chunk-YWJT3OG4.js L17: try { L18: return Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC"; L19: } catch { ... L193: try { L194: const obj = JSON.parse(await readFile(cacheFile(), "utf-8")); L195: for (const [path, s] of Object.entries(obj)) { ... L527: // src/providers/cursor/sqlite.ts L528: import { execFile as execFileCb } from "child_process"; L529: import { accessSync, constants } from "fs"; ... L586: const names = process.platform === "win32" ? ["sqlite3.exe", "sqlite3.cmd", "sqlite3.bat"] : ["sqlite3"]; L587: for (const dir of (process.env.PATH ?? "").split(delimiter).filter(Boolean)) { L588: for (const name of names) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-YWJT3OG4.jsView on unpkg · L17

dist/web/assets/jetbrains-mono-latin-ext-400-normal-fXTG6kC5.woffView file

•path = dist/web/assets/jetbrains-mono-latin-ext-400-normal-fXTG6kC5.woff kind = high_entropy_blob sizeBytes = 10128 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/assets/jetbrains-mono-latin-ext-400-normal-fXTG6kC5.woffView on unpkg

Findings

2 Critical2 High5 Medium6 Low

CriticalCredential Exfiltrationdist/chunk-YWJT3OG4.js

CriticalTrigger Reachable Dangerous Capabilitydist/chunk-YWJT3OG4.js

HighEvaldist/web/assets/index-B9eW55YB.js

HighShips High Entropy Blobdist/web/assets/jetbrains-mono-latin-ext-400-normal-fXTG6kC5.woff

MediumDynamic Requiredist/chunk-E6YT66ST.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

5 flagged

dist/web/assets/index-B9eW55YB.jsView file

High

Eval

Package source references dynamic code evaluation.

dist/web/assets/index-B9eW55YB.jsView on unpkg · L83

dist/chunk-E6YT66ST.jsView file

Lines 266-306javascript

266 return import.meta.url.includes("/src/");

267}

268function findWebSource() {

269 for (const rel of ["../../web/", "../web/", "./web/"]) {

270 try {

271 const dir = fileURLToPath2(new URL(rel, import.meta.url));

272 if (existsSync2(join2(dir, "vite.config.ts")) && existsSync2(join2(dir, "index.html"))) {

273 return dir.replace(/[\\/]+$/, "");

274 }

275 } catch {

276 }

277 }

278 return null;

279}

280async function createViteDevServer(httpServer, log) {

281 const root = findWebSource();

282 if (!root) {

283 log(" \u26A0 dev mode: web/ source not found");

284 return null;

285 }

286 try {

287 const req = createRequire(pathToFileURL(join2(root, "package.json")).href);

288 const vitePath = req.resolve("vite");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-E6YT66ST.jsView on unpkg · L286

289 const vite = await import(pathToFileURL(vitePath).href);

290 const dev = await vite.createServer({

291 root,

292 configFile: join2(root, "vite.config.ts"),

293 server: { middlewareMode: true, hmr: { server: httpServer } },

294 appType: "spa",

295 clearScreen: false,

296 logLevel: "warn"

297 });

298 log(" \u25C6 dev mode \u2014 Vite HMR attached (edit web/src and it hot-reloads)");

299 return dev;

300 } catch (e) {

301 log(` \u26A0 couldn't start Vite dev server: ${e.message}`);

302 log(" run `pnpm --prefix web install` (or `npm run web:install`) for HMR, or `npm run build` for a static bundle");

303 return null;

304 }

305}

306var MISSING_BUILD_HTML = `<!doctype html><html><head><meta charset="utf-8"><title>tokmon web</title>

dist/chunk-YWJT3OG4.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import {

3 PROVIDER_IDS,

4 cacheDir,

5 envDir,

6 expandHome,

7 isValidTimezone,

8 slugify

9} from "./chunk-XQEJ4WQ5.js";

11// src/providers/usage-core.ts

12import

dist/web/assets/jetbrains-mono-latin-ext-400-normal-fXTG6kC5.woffView file

•path = dist/web/assets/jetbrains-mono-latin-ext-400-normal-fXTG6kC5.woff kind = high_entropy_blob sizeBytes = 10128 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/assets/jetbrains-mono-latin-ext-400-normal-fXTG6kC5.woffView on unpkg