if you actually look at the code, it's a single 400 line python file that just wraps https://github.com/ryoppippi/ccusage, so it's possible
Up until recently I tended to “trust” github repos a bit more, now I feel like I need to have my guard up so I don’t fall into a trap of using something like this. Funnily enough a good first metric for me now is # of emojis in the readme - the more emojis the more likely you should stay away from it