registry / @taskless/cli-nightly / 0.11.2-20260915061418xb9b48c9
@taskless/cli-nightly@0.11.2-20260915061418xb9b48c9
⚠ Under reviewNightly build of [`@taskless/cli`](https://www.npmjs.com/package/@taskless/cli) — the same source and the same build, published from an unreleased commit on `main`.
Static Scan Results
scanned 1mo ago · by rust-scannerStatic analysis completed at 0.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.
Static reason
Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
4 flaggeddist/index.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { readFile as P, mkdir as B, writeFile as j, rm as re, readdir as ae, stat as ue, mkdtemp as ja, copyFile as af, glob as gi, access as lf, readlink as cf, rename as Da, cp a...
import { createReadStream as hf, globSync as pf, existsSync as es, readFileSync as Ba, mkdtempSync as gf, writeFileSync as mf, rmSync as yf } from "node:fs";
import wf, { createInterface as Gi } from "node:readline";
this.flushPromise = null, this.shutdownPromise = null, this.promiseQueue = new vh(), this._events = new Fh(), this._isInitialized = !1, _h(e, "You must pass your PostHog project's ...
throw this.beginBackoff(), new yt(`Your pro
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg9import { AsyncLocalStorage as bf } from "node:async_hooks";
L10: import { execFile as Lt, spawn as It } from "node:child_process";
L11: import { RULES_DIRECTORY as J, TASKLESS_DIRECTORY as vf, ENGINES as at, ENGINE_LAYOUTS as Pt, isKnownEngine as zi, RULE_TESTS_DIRECTORY as Me } from "./layout.js";
...
L20: import { o as Qr } from "./verify-test-BaZPwJqC.js";
L21: import ge, { stdout as Ga, stdin as bd } from "node:process";
L22: const le = {
...
L458: platform: Ad = ""
L459: } = typeof process > "u" ? {} : process, Td = "NO_COLOR" in We || za.includes("--no-color"), Cd = "FORCE_COLOR" in We || za.includes("--color"), Fd = Ad === "win32", Ja = We.TERM =...
L460: function Ha(t, e, n, s, i = e.slice(0, Math.max(0, t)) + s, r = e.slice(Math.max(0, t + n.length)), o = r.indexOf(n)) {
...
L
Findings
1 Critical3 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/recipes-CMBPNcbj.js
HighCredential Redirect Persistencedist/index.js
HighObfuscated Payload Loaderdist/index.js
HighSemantic Analysis Limitedassets/reference.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @taskless/cli-nightly@0.11.2-20260915061418xb9b48c9.
See all versions of @taskless/cli-nightly for other recorded verdicts.
- Review the evidence and your use of @taskless/cli-nightly@0.11.2-20260915061418xb9b48c9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.