@taskless/cli-nightly@0.11.1-20260904024645x341327d
Nightly build of [`@taskless/cli`](https://www.npmjs.com/package/@taskless/cli) — the same source and the same build, published from an unreleased commit on `main`.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete automatic malicious behavior or credential-redirection persistence was confirmed. The package nevertheless combines first-party AI-tool setup with an explicit untrusted-code execution mode, so it warrants a warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running taskless init --no-interactive or taskless check --dangerously-run-scripts.
Impact
Can alter AI-tool extensions and execute untrusted project rule code under the invoking user's permissions.
Mechanism
AI-tool skill installation and dynamic execution of local rule modules.
AI rationale
No concrete automatic malicious behavior or credential-redirection persistence was confirmed. The package nevertheless combines first-party AI-tool setup with an explicit untrusted-code execution mode, so it warrants a warning.
Evidence
dist/index.js.taskless/.run/runtime-rules.taskless/.env.local.json
Network endpoints1
z.taskless.io
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The user-invoked init command can install mandatory Taskless skills into every detected AI tool without prompting.
- Runtime rule checks dynamically import a local check file and call its default function, enabling execution of rule code.
- The package sends telemetry to z.taskless.io unless opted out.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
- Interactive init asks which tools to enable before writing skills.
- Runtime rules are skipped by default when unauthenticated and require an explicit dangerous flag to bypass verification.
- The reported base64 handling is JWT decoding, not an obfuscated payload loader.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStrings
Source & flagged code
6 flaggeddist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @taskless/cli-nightly@0.11.1-20260901180114x6bf4e26
matchedIdentity = npm:QHRhc2tsZXNzL2NsaS1uaWdodGx5:0.11.1-20260901180114x6bf4e26
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { mkdir as q, readFile as j, writeFile as P, rm as oe, readdir as de, stat as $e, mkdtemp as Aa, copyFile as qu, glob as Vu, access as Wu, readlink as Gu, rename as Ia, cp a...
import { createReadStream as Ju, existsSync as di, readFileSync as Fa, globSync as Yu, mkdtempSync as Qu, writeFileSync as Xu, rmSync as Zu } from "node:fs";
import ef, { createInterface as qi } from "node:readline";
this.flushPromise = null, this.shutdownPromise = null, this.promiseQueue = new th(), this._events = new fh(), this._isInitialized = !1, oh(e, "You must pass your PostHog project's ...
throw this.beginBackoff(), new mt(`Your pro
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsFindings
1 Critical3 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighCredential Redirect Persistencedist/index.js
HighObfuscated Payload Loaderdist/index.js
HighSemantic Analysis Limitedassets/demo-reference.json
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/index.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @taskless/cli-nightly@0.11.1-20260904024645x341327d.
See all versions of @taskless/cli-nightly for other recorded verdicts.
- Review the evidence and your use of @taskless/cli-nightly@0.11.1-20260904024645x341327d before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.