A developer tool posted on X this week asks you to paste one line into your terminal, and that line uploads your private AI chats to a company's servers. The tool is real and the company is funded. But never run something you copied from a social post until you know what it does.
Run "npx standout" and npx downloads and executes a package in one step without installing it, so the code runs the moment you press enter. Alexis Aftalion, co-founder of the YC-backed startup Standout, posted it on June 5 as harmless fun. It turns how you use AI coding tools into a score, a leaderboard, and a shareable "AI Wrapped" card. Read the package before you run it.
What this one actually does
It looks at the folders your AI coding tools leave on disk, then reads the real conversations inside, not just a token count. For Claude Code, Codex, and Cursor it pulls samples of the actual prompts you typed and the replies you got, going back about a month. It also collects your name and handles from GitHub, LinkedIn, and X. Then it uploads the bundle to Standout's servers to build a profile on you. Standout sells recruiting, and the stats card is the hook that gets people to run it.
To be fair, Standout is not hiding any of this. The tool links its privacy policy, asks "Continue? [Y/n]" in a real terminal, and strips obvious secrets like API keys before sending. Those are real safeguards. But the filter only catches things that look like keys, so the content of your chats, your code, and your client notes still leaves your machine.
The same trick attackers use
Here is why a real company matters even though it is not a hacking crew. It is the same move attackers use to spread bad code. A hype post tells you to run a one-liner right now or miss out, and you paste it before you think. You cannot tell a safe command from a harmful one by reading the post around it. Running things on impulse is how machines get compromised.
Two details make it worse. Standout pushed 19 versions of the package in about two days, and npx always grabs the newest one, so what runs can change from one day to the next. What a friend checked yesterday is not what you run today. It also skips the "Continue?" question when a script or an AI agent runs it instead of a person, and it uploads anyway. Your own coding assistant could send your history off with nothing on screen for you to catch.
How to check before you run
Do not run a command from a post until you have read what it does. You can pull the source without running it. Running "npm view standout" shows the package details, and "npm pack standout" downloads the code as a file you can open and read. Watch for anything that reads your files or calls out to a server you do not recognize. If it does and you cannot say why, walk away.
Free stats are not worth handing over your prompts, your code, and your keys. Read the source first, and run only what you actually understand.
