@taskless/cli-nightly@0.13.0-20261016182619x41fd794
Nightly build of [`@taskless/cli`](https://www.npmjs.com/package/@taskless/cli) — the same source and the same build, published from an unreleased commit on `main`.
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe entrypoint uses an explicit environment or saved API URL override for authenticated requests, so a custom untrusted destination can receive the token. The scanner's fixed-gateway and hidden-payload claims are not supported by the inspected source; no install lifecycle hook is present.
Static reason
One or more suspicious static signals were detected.
Trigger
A CLI operation makes an authenticated API request while TASKLESS_API_URL or the saved API URL points to a custom host.
Impact
A custom destination could receive the Taskless token; the source does not establish that the package selects an unrelated fixed recipient.
Mechanism
The token is loaded from the environment or repository credentials and sent as a bearer authorization header to the configured API base URL.
AI rationale
The entrypoint uses an explicit environment or saved API URL override for authenticated requests, so a custom untrusted destination can receive the token. The scanner's fixed-gateway and hidden-payload claims are not supported by the inspected source; no install lifecycle hook is present.
Evidence
dist/index.js
Network endpoints1
app.taskless.io/cli
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI accepts a custom API destination from an environment variable or saved configuration, with the Taskless service as its default.
- The CLI loads a Taskless token from the environment or repository credentials and attaches it as a bearer token to API requests using that destination.
- The inspected agent-related code declares project-level agent detection and install directories; it does not establish an agent control-surface attack.
- The manifest exposes the bundled CLI but shows no install lifecycle hook.
Evidence against
- The flagged eval example is bundled demonstration content, not an active payload loader.
- The inspected base64 decoding helpers serve ordinary token or binary decoding; they do not establish hidden-code execution.
Behavioral surface
ChildProcessCryptoEvalFilesystemNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
4 flaggeddist/index.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { readFile as x, mkdir as z, writeFile as B, rm as oe, readdir as Q, stat as $e, mkdtemp as No, copyFile as ou, glob as au, access as Qp, readlink as Zp, rename as rt, cp as...
import { createReadStream as rg, globSync as Lo, readdirSync as og, existsSync as qn, readFileSync as lu, rmSync as cu, mkdtempSync as ag, writeFileSync as lg } from "node:fs";
import cg, { createInterface as Zn } from "node:readline";
this.flushPromise = null, this.shutdownPromise = null, this.promiseQueue = new Oy(), this._events = new My(), this._isInitialized = !1, Cy(t, "You must pass your PostHog project's ...
throw this.beginBackoff(
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg1#!/usr/bin/env node
L2: import T, { stdin as Hp, stdout as iu } from "node:process";
L3: import * as Xi from "node:tty";
...
L10: import { AsyncLocalStorage as ug } from "node:async_hooks";
L11: import { execFile as $n, spawn as ut } from "node:child_process";
L12: import { RULES_DIRECTORY as Z, TASKLESS_DIRECTORY as fg, ENGINES as Me, ENGINE_LAYOUTS as kt, RULE_TESTS_DIRECTORY as ve, isKnownEngine as qt } from "./layout.js";
...
L458: platform: Rm = ""
L459: } = typeof process > "u" ? {} : process, Nm = "NO_COLOR" in wt || gu.includes("--no-color"), Fm = "FORCE_COLOR" in wt || gu.includes("--color"), Lm = Rm === "win32", mu = wt.TERM =...
L460: function yu(e, t, n, s, i = t.slice(0, Math.max(0, e)) + s, r = t.slice(Math.max(0, e + n.length)), o = r.indexOf(n)) {
...
L629: }
L630: for
Findings
2 High4 Medium6 Low
HighCredential Redirect Persistencedist/index.js
HighObfuscated Payload Loaderdist/index.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist/index.js
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @taskless/cli-nightly@0.13.0-20261016182619x41fd794.
See all versions of @taskless/cli-nightly for other recorded verdicts.
- Review the evidence and your use of @taskless/cli-nightly@0.13.0-20261016182619x41fd794 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.