@taskless/cli-nightly@0.11.2-20260908181852x4929ad3
Nightly build of [`@taskless/cli`](https://www.npmjs.com/package/@taskless/cli) — the same source and the same build, published from an unreleased commit on `main`.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo install lifecycle hook or concealed payload was found. The package nevertheless provides a dangerous, remotely mediated runtime-rule execution capability, so it warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
Run taskless check with --dangerously-run-scripts, or run an authenticated check that accepts reconciled runtime rules.
Impact
A malicious runtime rule can run arbitrary code with the invoking user's permissions.
Mechanism
Dynamic import and child-process execution of project check.ts files.
AI rationale
No install lifecycle hook or concealed payload was found. The package nevertheless provides a dangerous, remotely mediated runtime-rule execution capability, so it warrants a warning rather than a block.
Evidence
dist/index.js.taskless/rules/runtime/*/check.ts.taskless/.run/runtime-rules
Network endpoints1
app.taskless.io
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The CLI explicitly offers a flag that executes untrusted runtime-rule code.
- Its runtime harness dynamically imports a project rule's check.ts and runs it in a child Node process.
- Authenticated checks can execute runtime rules after a remote reconciliation decision.
Evidence against
- package.json has no preinstall, install, postinstall, or other lifecycle hook.
- The unsafe local execution path requires an explicit --dangerously-run-scripts flag and emits a warning.
- The reported base64 and eval signals are library/parser code and embedded examples, not a hidden payload loader.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
5 flaggeddist/recipes-C8h8MtDA.jsView file
173"severity": "error",
L174: "message": "Avoid eval()",
L175: "note": null,
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/recipes-C8h8MtDA.jsView on unpkg · L173dist/index.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { mkdir as B, readFile as D, writeFile as P, rm as re, readdir as ae, stat as we, mkdtemp as Ta, copyFile as Wu, glob as Ku, access as Gu, readlink as zu, rename as Ca, cp a...
import { createReadStream as Qu, existsSync as hi, readFileSync as Ra, globSync as Xu, mkdtempSync as Zu, writeFileSync as ef, rmSync as tf } from "node:fs";
import nf, { createInterface as Vi } from "node:readline";
this.flushPromise = null, this.shutdownPromise = null, this.promiseQueue = new rh(), this._events = new gh(), this._isInitialized = !1, uh(e, "You must pass your PostHog project's ...
throw this.beginBackoff(), new mt(`Your pro
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
3 High4 Medium6 Low
HighCredential Redirect Persistencedist/index.js
HighObfuscated Payload Loaderdist/index.js
HighSemantic Analysis Limitedassets/reference.json
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/recipes-C8h8MtDA.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @taskless/cli-nightly@0.11.2-20260908181852x4929ad3.
See all versions of @taskless/cli-nightly for other recorded verdicts.
- Review the evidence and your use of @taskless/cli-nightly@0.11.2-20260908181852x4929ad3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.