registry / tokn-app / 0.1.0

tokn-app@0.1.0

Daily AI token usage and cost across **Claude Code**, **Codex**, and **Cursor**, in two forms:

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 27 file(s), 102 KB of source, external domains: cursor.com, www.neuralmindlabs.com

Source & flagged code

3 flagged

scripts/validate.tsView file

Lines 1-25typescript

1/**

2 * Cross-check our Claude Code parsing + pricing against ccusage

3 * (independent implementation over the same JSONL files).

4 * Run: npm run validate

5 */

6import { execSync } from 'node:child_process';

7import { readFileSync, readdirSync } from 'node:fs';

High

Child Process

Package source references child process execution.

scripts/validate.tsView on unpkg · L5

8import { join } from 'node:path';

9import { homedir } from 'node:os';

10import { parseClaudeSession } from '@neuralmindlabs/tokn';

11import { parseCodexSession } from '@neuralmindlabs/tokn';

12import { eventsToDays } from '@neuralmindlabs/tokn';

13import type { UsageEvent } from '@neuralmindlabs/tokn';

15function* jsonlFiles(dir: string): Generator<string> {

16 for (const entry of readdirSync(dir, { withFileTypes: true })) {

17 const p = join(dir, entry.name);

18 if (entry.isDirectory()) yield* jsonlFiles(p);

19 else if (entry.name.endsWith('.jsonl')) yield p;

20 }

21}

23const dedupe = new Set<string>();

24const events: UsageEvent[] = [];

25let files = 0;

Lines 63-103typescript

63 }

64 }

65 const ourTotal = parsed.reduce((s, e) => s + e.inputTokens + e.outputTokens, 0);

66 // with counter resets the session total is unrecoverable from the last value alone

67 if (resets === 0 && finalTotal > 0

src-tauri/icons/icon.icnsView file

•path = src-tauri/icons/icon.icns kind = high_entropy_blob sizeBytes = 373314 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src-tauri/icons/icon.icnsView on unpkg

Source & flagged code

3 flagged · loading source

scripts/validate.tsView file

5*/ L6: import { execSync } from 'node:child_process'; L7: import { readFileSync, readdirSync } from 'node:fs';

High

Child Process

Package source references child process execution.

scripts/validate.tsView on unpkg · L5

83console.log('running ccusage (this downloads the package on first run)...'); L84: const raw = execSync('npx --yes ccusage@latest daily --json', { L85: encoding: 'utf8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/validate.tsView on unpkg · L83

src-tauri/icons/icon.icnsView file

•path = src-tauri/icons/icon.icns kind = high_entropy_blob sizeBytes = 373314 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src-tauri/icons/icon.icnsView on unpkg

Findings

4 High3 Medium5 Low

HighChild Processscripts/validate.ts

HighShell

HighRuntime Package Installscripts/validate.ts

HighShips High Entropy Blobsrc-tauri/icons/icon.icns

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

scripts/validate.tsView file

Lines 1-25typescript

1/**

2 * Cross-check our Claude Code parsing + pricing against ccusage

3 * (independent implementation over the same JSONL files).

4 * Run: npm run validate

5 */

6import { execSync } from 'node:child_process';

7import { readFileSync, readdirSync } from 'node:fs';

High

Child Process

Package source references child process execution.

scripts/validate.tsView on unpkg · L5

8import { join } from 'node:path';

9import { homedir } from 'node:os';

10import { parseClaudeSession } from '@neuralmindlabs/tokn';

11import { parseCodexSession } from '@neuralmindlabs/tokn';

12import { eventsToDays } from '@neuralmindlabs/tokn';

13import type { UsageEvent } from '@neuralmindlabs/tokn';

15function* jsonlFiles(dir: string): Generator<string> {

16 for (const entry of readdirSync(dir, { withFileTypes: true })) {

17 const p = join(dir, entry.name);

18 if (entry.isDirectory()) yield* jsonlFiles(p);

19 else if (entry.name.endsWith('.jsonl')) yield p;

20 }

21}

23const dedupe = new Set<string>();

24const events: UsageEvent[] = [];

25let files = 0;

Lines 63-103typescript

63 }

64 }

65 const ourTotal = parsed.reduce((s, e) => s + e.inputTokens + e.outputTokens, 0);

66 // with counter resets the session total is unrecoverable from the last value alone

67 if (resets === 0 && finalTotal > 0

src-tauri/icons/icon.icnsView file

•path = src-tauri/icons/icon.icns kind = high_entropy_blob sizeBytes = 373314 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src-tauri/icons/icon.icnsView on unpkg