@bumpyclock/tasque
Simple local-first task tracker. Git-friendly. No DB.
This report shows the evidence for @bumpyclock/tasque@0.9.0. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiNative binary download is package-aligned for a CLI wrapper, but executing that binary during postinstall to refresh bundled agent skills is unconsented lifecycle AI-agent control-surface mutation. No credential theft or generic malware behavior was found in the JS source, but this install-time agent-control write path is enough to block. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.
Decision evidence
public snapshot- package.json defines postinstall: node scripts/postinstall.js
- scripts/postinstall.js downloads platform binaries from https://registry.npmjs.org/... when optional dependency binary is absent
- scripts/postinstall.js writes downloaded binaries into bin/ and chmods them executable
- scripts/postinstall.js runs the resolved tsq binary during postinstall with args: skills refresh --json
- postinstall sets TSQ_SKILLS_DIR to bundled SKILLS, creating install-time agent skill refresh behavior
- bin/tsq.js only resolves and spawns the tsq binary for user-invoked CLI commands
- network endpoint is npm registry and package-aligned for native binary fallback
- no credential harvesting, shell=true execution, destructive commands, persistence code, or arbitrary eval found in JS source
- redirects are restricted to https and same host or npmjs.org
- bundled SKILLS content appears to document tasque usage, not prompt exfiltration
Source & flagged code
2 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @bumpyclock/tasque@0.9.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @bumpyclock/tasque@0.9.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.