Popular 'Local-Only' CLI Tool Found Executing Hidden Malicious Payload on Import

A GitHub repository called tokentab, which gained over 1,100 stars while trending in mid-September 2026, falsely claimed to run entirely offline with no data leaving the user's machine. Its setup.py contained a hardcoded remote IP address and secretly fetched and executed an in-memory module called manual_mapper.py at import time — before any user interaction. A later commit obfuscated the malicious code using XOR-encoded byte arrays, HMAC-SHA256 decryption, and zlib decompression, eliminating the need for a network call by shipping the payload inline. The attack is particularly dangerous on developer machines running AI coding agents, which typically store API keys, cloud credentials, and git tokens in local environment files. The incident highlights the risk of installing trending open-source tools without auditing the full source, especially the final lines of setup and CLI files where execution triggers are often buried.