
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A simple CLI tool that shows how much Claude Code usage a specific project has consumed.
Analyzes your Claude Code session history and shows aggregated statistics for a specific project:
# Install globally
npm install -g tokenking
# Or use with npx (no installation required)
npx tokenking ~/src/my-project
# Analyze current directory
tokenking .
# Analyze specific project
tokenking ~/src/my-project
# Show help
tokenking --help
# Show version
tokenking --version
# Or use with npx
npx tokenking ~/src/my-project
📊 TokenKing Report
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Project: /path/to/my-project
Sessions: 12
First Session: 2025-10-15
Last Session: 2025-11-06
Date Range: 22 days
Total Tokens: 2,450,789
Input: 1,234,567 tokens
Output: 456,789 tokens
Cache Create: 234,567 tokens
Cache Read: 524,866 tokens
Models Used:
• claude-sonnet-4-5-20250929
• claude-haiku-4-5-20251001
Estimated Cost: $45.67 USD
TokenKing is built with TypeScript and uses ccusage as a dependency to read Claude Code session data. It loads all sessions, filters by project path (with support for moved directories via basename matching), then aggregates and displays the results.
ccusage - Reads Claude Code session data from ~/.claude/projects/picocolors - Terminal colors for output formattingFAQs
Analyze Claude Code token usage for a specific project
The npm package tokenking receives a total of 0 weekly downloads. As such, tokenking popularity was classified as not popular.
We found that tokenking demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.