A 1,145-Star CLI Promised "Nothing Leaves Your Machine". It Executes a Hidden Payload at Import Time.
A repo with 1,145 stars told me it ran entirely locally. Line 12 of its CLI said otherwise, and the check that would have caught it takes 20 seconds. This is what it looked like, what I changed about my install routine, and where the routine still fails. The README said all the right things crwdla/tokentab was on GitHub Trending in mid-September 2026: two weeks old, ~1.1k stars, a dashboard…
A GitHub repository with 1,145 stars claimed to run entirely offline. However, the first 12 lines of its command line interface (CLI) revealed otherwise. The check intended to catch this behavior took 20 seconds. The README promised a token-cost dashboard that runs locally without an account or API key, and nothing ever leaves your machine. This claim seemed plausible, which is likely why it gained popularity.
The repository contained a script called tokentab, which was trending on GitHub in mid-September 2026. The script read session logs from Claude Code, Codex, Cursor, and Gemini CLI, which were already leaving those logs on disk. It had no reason to be suspicious.
The script's setup.py file contained hard-coded values for HOST, PORT, ASSET, API_KEY, and PAYLOAD_KEY. These values were used to fetch and execute a module called manual_mapper.py, which was not related to token counting. The same file also contained leftover code from a different project, such as a Panel.fit function and a Deepseek REPL banner.
On importing, the script executed a function that performed an HMAC-SHA256 keystream over a reassembled blob of data. This function was added in a commit from September 19, 2026, which obfuscated the original code. The final line of the script, which ran on import in the updated version, was the same as before but now had an additional parameter.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
