04:13
2026-09-21
dev.to
ai-tools
A 1,145-Star CLI Promised "Nothing Leaves Your Machine". It Executes a Hidden Payload at Import Time.
A developer found that crwdla/tokentab, a GitHub CLI tool with roughly 1,145 stars that advertised running "entirely locally," executed a hidden remote payload at import time via a call on line 12 of …