registry / @taskless/cli-nightly / 0.12.0-20260905054725xefa3036
@taskless/cli-nightly@0.12.0-20260905054725xefa3036
Nightly build of [`@taskless/cli`](https://www.npmjs.com/package/@taskless/cli) — the same source and the same build, published from an unreleased commit on `main`.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not a concrete malicious install chain, but it contains user-invoked AI-agent control-surface setup and guarded execution of project runtime rules. It warrants a warning because those capabilities can materially affect an AI-enabled project.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs taskless init, or runs checks with runtime rules enabled.
Impact
A user who enables these features allows Taskless-managed instructions or runtime rule code to affect the project environment.
Mechanism
AI-agent extension installation and guarded dynamic runtime-rule execution.
AI rationale
This is not a concrete malicious install chain, but it contains user-invoked AI-agent control-surface setup and guarded execution of project runtime rules. It warrants a warning because those capabilities can materially affect an AI-enabled project.
Evidence
dist/index.js.taskless/.claude/skills/.cursor/skills/.opencode/skills/.agents/skills/
Network endpoints2
app.taskless.io/cliz.taskless.io
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The explicit init command detects several AI-tool project directories and installs Taskless skill or command stubs there.
- Runtime rules dynamically import a project-supplied check file; the CLI labels this as execution of untrusted code.
- The installer presents a summary and can cancel before it creates its Taskless files and selected tool stubs.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
- No self-dependency or obfuscated payload loader was found in the inspected package source.
- Authentication uses an interactive device flow and stores its token in the project-local .taskless directory.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsTelemetry
Source & flagged code
6 flaggeddist/recipes-B4YKMasn.jsView file
173"severity": "error",
L174: "message": "Avoid eval()",
L175: "note": null,
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/recipes-B4YKMasn.jsView on unpkg · L173dist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @taskless/cli-nightly@0.11.1-20260904165917x8feee4c
matchedIdentity = npm:QHRhc2tsZXNzL2NsaS1uaWdodGx5:0.11.1-20260904165917x8feee4c
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { mkdir as q, readFile as j, writeFile as P, rm as oe, readdir as fe, stat as $e, mkdtemp as Ia, copyFile as qu, glob as Vu, access as Wu, readlink as Ku, rename as Ta, cp a...
import { createReadStream as Ju, existsSync as di, readFileSync as Oa, globSync as Yu, mkdtempSync as Qu, writeFileSync as Xu, rmSync as Zu } from "node:fs";
import ef, { createInterface as qi } from "node:readline";
this.flushPromise = null, this.shutdownPromise = null, this.promiseQueue = new sh(), this._events = new hh(), this._isInitialized = !1, lh(e, "You must pass your PostHog project's ...
throw this.beginBackoff(), new yt(`Your pro
Findings
1 Critical3 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighCredential Redirect Persistencedist/index.js
HighObfuscated Payload Loaderdist/index.js
HighSemantic Analysis Limitedassets/reference.json
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/recipes-B4YKMasn.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @taskless/cli-nightly@0.12.0-20260905054725xefa3036.
See all versions of @taskless/cli-nightly for other recorded verdicts.
- Review the evidence and your use of @taskless/cli-nightly@0.12.0-20260905054725xefa3036 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.