theuni.socialTokenmaxxing
Will installing Tokenmaxxing get me hacked?
Installing the official uni-social-tokens package does not give the website control of your laptop. It does run software locally, though, so no one should promise that any npm install has zero risk.
What does it actually do?
The CLI reads local usage records from supported AI coding tools through ccusage. After you connect it with a one-time code from your Tokenmaxxing page, it sends daily token totals and usage details to your account. It does not ask for your university password.
Installing alone does not connect your account or start automatic sync. The separate --install-autosync command creates a user-level scheduled job, which runs about every 15 minutes while your laptop is on.
What leaves my computer?
Dates, tool names, token totals and types, estimated cost, model names, and per-model totals. The CLI does not upload prompts, source code, file paths, or chat transcripts. Your detailed charts are private to your account; the campus board uses totals. See the complete data breakdown.
How can I check before connecting?
- Use the exact package name
uni-social-tokensfrom the npm package page. Check the name before installing. - After installation, run
uni-social-tokens --dry-run. It previews the records it would send without pairing or uploading. - Only enter the connection code into the CLI if you want to join the leaderboard. Do not share that code with another person.
How do I turn it off?
Run uni-social-tokens --remove-autosync to stop the scheduled job. In Tokenmaxxing, choose Disconnect & delete data for the laptop to revoke its connection and remove its uploaded totals. To remove the program, run npm uninstall -g uni-social-tokens.