registry / tokmon / 0.21.0

tokmon@0.21.0

⚠ Under review

Terminal + web dashboard for Claude Code, Codex, Cursor, opencode, pi, Copilot, Gemini & more — usage, limits, and costs

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 1.29 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.openai.com, api2.cursor.sh, chatgpt.com, cloudcode-pa.googleapis.com, cursor.com, davidilie.com, fb.me, github.com, nuqs.dev, oauth2.googleapis.com, promoclock.co, reactjs.org, www.w3.org

Source & flagged code

5 flagged

dist/bootstrap-ink-QHJOOWIW.jsView file

Lines 1648-1688javascript

1648 /* @__PURE__ */ jsxs10(Text10, { color: meta.color, children: [

1649 glyphs().dot,

1650 " "

1651 ] }),

1652 /* @__PURE__ */ jsx10(Text10, { bold: true, color: meta.color, children: name }),

1653 /* @__PURE__ */ jsx10(Box10, { flexGrow: 1 }),

1654 /* @__PURE__ */ jsx10(Text10, { dimColor: true, children: detail })

1655 ] });

1656}

1657

1658// src/client/use-daemon.ts

1659import { useEffect as useEffect3, useMemo, useRef as useRef2, useState as useState3 } from "react";

1660

1661// src/client/daemon-rpc-client.ts

1662import { Cause, Context, Duration, Effect, Fiber, Layer, ManagedRuntime, Schedule, Stream } from "effect";

1663import { RpcClient, RpcSerialization } from "effect/unstable/rpc";

1664import * as Socket from "effect/unstable/socket/Socket";

1665var TokmonRpcClient = class extends Context.Service()(

1666 "tokmon/client/DaemonRpcClient/TokmonRpcClient"

1667) {

1668};

1669var dynamicImport = new Function("specifier", "return import(specifier)");

1670function toWsUrl(baseUrl, token) {

High

Eval

Package source references dynamic code evaluation.

dist/bootstrap-ink-QHJOOWIW.jsView on unpkg · L1668

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bootstrap-ink-QHJOOWIW.jsView on unpkg · L1668

1671 const base = typeof window === "undefined" ? void 0 : window.location.origin;

1672 const url = new URL(baseUrl, base);

1673 if (url.protocol === "http:") url.protocol = "ws:";

1674 else if (url.protocol === "https:") url.protocol = "wss:";

1675 if (url.protocol !== "ws:" && url.protocol !== "wss:") {

1676 throw new Error(`unsupported daemon RPC protocol: ${url.protocol}`);

1677 }

1678 url.pathname = TOKMON_WS_PATH;

1679 if (token) url.searchParams.set("wsToken", token);

1680 return url.toString();

1681}

1682function shouldUseNodeTransport(transport) {

1683 if (transport === "node") return true;

1684 if (transport === "browser") return false;

1685 return typeof window === "undefined";

1686}

1687async function socketLayerFor(url, transport) {

1688 if (shouldUseNodeTransport(transport)) {

dist/chunk-YCIUMAKK.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import {

3 PROVIDER_IDS,

4 cacheDir,

5 envDir,

6 expandHome,

7 isValidTimezone,

8 slugify

9} from "./chunk-7MFZMI5C.js";

11// src/providers/usage-core.ts

12import

dist/web/assets/jetbrains-mono-latin-ext-400-normal-fXTG6kC5.woffView file

•path = dist/web/assets/jetbrains-mono-latin-ext-400-normal-fXTG6kC5.woff kind = high_entropy_blob sizeBytes = 10128 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/assets/jetbrains-mono-latin-ext-400-normal-fXTG6kC5.woffView on unpkg

Source & flagged code

5 flagged · loading source

dist/bootstrap-ink-QHJOOWIW.jsView file

1668}; L1669: var dynamicImport = new Function("specifier", "return import(specifier)"); L1670: function toWsUrl(baseUrl, token) {

High

Eval

Package source references dynamic code evaluation.

dist/bootstrap-ink-QHJOOWIW.jsView on unpkg · L1668

1668}; L1669: var dynamicImport = new Function("specifier", "return import(specifier)"); L1670: function toWsUrl(baseUrl, token) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bootstrap-ink-QHJOOWIW.jsView on unpkg · L1668

dist/chunk-YCIUMAKK.jsView file

17try { L18: return Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC"; L19: } catch { ... L201: try { L202: const obj = JSON.parse(await readFile(cacheFile(), "utf-8")); L203: for (const [path, s] of Object.entries(obj)) { ... L570: // src/providers/cursor/sqlite.ts L571: import { execFile as execFileCb } from "child_process"; L572: import { accessSync, constants } from "fs"; ... L629: const names = process.platform === "win32" ? ["sqlite3.exe", "sqlite3.cmd", "sqlite3.bat"] : ["sqlite3"]; L630: for (const dir of (process.env.PATH ?? "").split(delimiter).filter(Boolean)) { L631: for (const name of names) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-YCIUMAKK.jsView on unpkg · L17

17Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/daemon-LZVP4SWF.js -> dist/chunk-YCIUMAKK.js L17: try { L18: return Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC"; L19: } catch { ... L201: try { L202: const obj = JSON.parse(await readFile(cacheFile(), "utf-8")); L203: for (const [path, s] of Object.entries(obj)) { ... L570: // src/providers/cursor/sqlite.ts L571: import { execFile as execFileCb } from "child_process"; L572: import { accessSync, constants } from "fs"; ... L629: const names = process.platform === "win32" ? ["sqlite3.exe", "sqlite3.cmd", "sqlite3.bat"] : ["sqlite3"]; L630: for (const dir of (process.env.PATH ?? "").split(delimiter).filter(Boolean)) { L631: for (const name of names) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-YCIUMAKK.jsView on unpkg · L17

dist/web/assets/jetbrains-mono-latin-ext-400-normal-fXTG6kC5.woffView file

•path = dist/web/assets/jetbrains-mono-latin-ext-400-normal-fXTG6kC5.woff kind = high_entropy_blob sizeBytes = 10128 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/assets/jetbrains-mono-latin-ext-400-normal-fXTG6kC5.woffView on unpkg

Findings

2 Critical2 High5 Medium6 Low

CriticalCredential Exfiltrationdist/chunk-YCIUMAKK.js

CriticalTrigger Reachable Dangerous Capabilitydist/chunk-YCIUMAKK.js

HighEvaldist/bootstrap-ink-QHJOOWIW.js

HighShips High Entropy Blobdist/web/assets/jetbrains-mono-latin-ext-400-normal-fXTG6kC5.woff

MediumDynamic Requiredist/bootstrap-ink-QHJOOWIW.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

5 flagged

dist/bootstrap-ink-QHJOOWIW.jsView file

Lines 1648-1688javascript

1648 /* @__PURE__ */ jsxs10(Text10, { color: meta.color, children: [

1649 glyphs().dot,

1650 " "

1651 ] }),

1652 /* @__PURE__ */ jsx10(Text10, { bold: true, color: meta.color, children: name }),

1653 /* @__PURE__ */ jsx10(Box10, { flexGrow: 1 }),

1654 /* @__PURE__ */ jsx10(Text10, { dimColor: true, children: detail })

1655 ] });

1656}

1657

1658// src/client/use-daemon.ts

1659import { useEffect as useEffect3, useMemo, useRef as useRef2, useState as useState3 } from "react";

1660

1661// src/client/daemon-rpc-client.ts

1662import { Cause, Context, Duration, Effect, Fiber, Layer, ManagedRuntime, Schedule, Stream } from "effect";

1663import { RpcClient, RpcSerialization } from "effect/unstable/rpc";

1664import * as Socket from "effect/unstable/socket/Socket";

1665var TokmonRpcClient = class extends Context.Service()(

1666 "tokmon/client/DaemonRpcClient/TokmonRpcClient"

1667) {

1668};

1669var dynamicImport = new Function("specifier", "return import(specifier)");

1670function toWsUrl(baseUrl, token) {

High

Eval

Package source references dynamic code evaluation.

dist/bootstrap-ink-QHJOOWIW.jsView on unpkg · L1668

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bootstrap-ink-QHJOOWIW.jsView on unpkg · L1668

1671 const base = typeof window === "undefined" ? void 0 : window.location.origin;

1672 const url = new URL(baseUrl, base);

1673 if (url.protocol === "http:") url.protocol = "ws:";

1674 else if (url.protocol === "https:") url.protocol = "wss:";

1675 if (url.protocol !== "ws:" && url.protocol !== "wss:") {

1676 throw new Error(`unsupported daemon RPC protocol: ${url.protocol}`);

1677 }

1678 url.pathname = TOKMON_WS_PATH;

1679 if (token) url.searchParams.set("wsToken", token);

1680 return url.toString();

1681}

1682function shouldUseNodeTransport(transport) {

1683 if (transport === "node") return true;

1684 if (transport === "browser") return false;

1685 return typeof window === "undefined";

1686}

1687async function socketLayerFor(url, transport) {

1688 if (shouldUseNodeTransport(transport)) {

dist/chunk-YCIUMAKK.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import {

3 PROVIDER_IDS,

4 cacheDir,

5 envDir,

6 expandHome,

7 isValidTimezone,

8 slugify

9} from "./chunk-7MFZMI5C.js";

11// src/providers/usage-core.ts

12import

dist/web/assets/jetbrains-mono-latin-ext-400-normal-fXTG6kC5.woffView file

•path = dist/web/assets/jetbrains-mono-latin-ext-400-normal-fXTG6kC5.woff kind = high_entropy_blob sizeBytes = 10128 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/assets/jetbrains-mono-latin-ext-400-normal-fXTG6kC5.woffView on unpkg