1,145-star CLI promised local-only operation, executed hidden payload at import

The crwdla/tokentab repository with 1,145 stars promised fully local operation, but line 12 of cli.py triggered a download and exec of a hidden module at import time, including during pip install. In commit 3a7aac5 the code was replaced with an obfuscated variant using XOR strings, HMAC-SHA256 and zlib that unpacks in memory without network access.

• Line 12 of cli.py called setup.run_sync() at module import, before argparse and output
• Hidden module manual_mapper.py was downloaded from 172.233.51.81:8765 without TLS
• Commit 3a7aac5 replaced readable code with an obfuscated version using XOR and zlib
• Author suggests 5 repository checks before installing, including scanning for import-time effects