registry / @taskless/cli-nightly / 0.11.2-20260917003938xf4f5e0e
@taskless/cli-nightly@0.11.2-20260917003938xf4f5e0e
⚠ Under reviewNightly build of [`@taskless/cli`](https://www.npmjs.com/package/@taskless/cli) — the same source and the same build, published from an unreleased commit on `main`.
Static Scan Results
scanned 1mo ago · by rust-scannerStatic analysis completed at 0.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.
Static reason
Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
4 flaggeddist/index.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { readFile as P, mkdir as B, writeFile as j, rm as re, readdir as ae, stat as ue, mkdtemp as Da, copyFile as cf, glob as gi, access as uf, readlink as ff, rename as Ma, cp a...
import { createReadStream as gf, globSync as mf, existsSync as es, readFileSync as qa, mkdtempSync as yf, writeFileSync as wf, rmSync as bf } from "node:fs";
import vf, { createInterface as Gi } from "node:readline";
this.flushPromise = null, this.shutdownPromise = null, this.promiseQueue = new kh(), this._events = new Rh(), this._isInitialized = !1, Ah(e, "You must pass your PostHog project's ...
throw this.beginBackoff(), new yt(`Your pro
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg9import { AsyncLocalStorage as Sf } from "node:async_hooks";
L10: import { execFile as Pt, spawn as It } from "node:child_process";
L11: import { RULES_DIRECTORY as J, TASKLESS_DIRECTORY as kf, ENGINES as at, ENGINE_LAYOUTS as jt, isKnownEngine as zi, RULE_TESTS_DIRECTORY as Me } from "./layout.js";
...
L20: import { o as Qr } from "./verify-test-BaZPwJqC.js";
L21: import ge, { stdout as za, stdin as Sd } from "node:process";
L22: const le = {
...
L458: platform: Td = ""
L459: } = typeof process > "u" ? {} : process, Fd = "NO_COLOR" in We || Ja.includes("--no-color"), Od = "FORCE_COLOR" in We || Ja.includes("--color"), Rd = Td === "win32", Ha = We.TERM =...
L460: function Ya(t, e, n, s, i = e.slice(0, Math.max(0, t)) + s, r = e.slice(Math.max(0, t + n.length)), o = r.indexOf(n)) {
...
L
Findings
1 Critical3 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/recipes-8bbPxPVH.js
HighCredential Redirect Persistencedist/index.js
HighObfuscated Payload Loaderdist/index.js
HighSemantic Analysis Limitedassets/reference.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @taskless/cli-nightly@0.11.2-20260917003938xf4f5e0e.
See all versions of @taskless/cli-nightly for other recorded verdicts.
- Review the evidence and your use of @taskless/cli-nightly@0.11.2-20260917003938xf4f5e0e before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.