registry / @taskless/cli-nightly / 0.13.4-20261029223938xcd2357c
@taskless/cli-nightly@0.13.4-20261029223938xcd2357c
Nightly build of [`@taskless/cli`](https://www.npmjs.com/package/@taskless/cli) — the same source and the same build, published from an unreleased commit on `main`.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe credential-related code is in a launcher flow for installing the project's pinned Taskless CLI; it temporarily supplies the project npm configuration to npm and removes the copy afterward. The manifest declares no install lifecycle hook, and the reviewed code does not show credentials being sent to an unrelated host.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the Taskless CLI or a launcher generated by the Taskless installer.
Impact
Installs and runs the pinned Taskless CLI; the inspected code does not show npm credentials being sent to an unrelated collector.
Mechanism
On a cache miss, the launcher runs npm ci for the version pinned in the project lockfile, temporarily copying the project's .npmrc into the install directory and removing it afterward.
AI rationale
The credential-related code is in a launcher flow for installing the project's pinned Taskless CLI; it temporarily supplies the project npm configuration to npm and removes the copy afterward. The manifest declares no install lifecycle hook, and the reviewed code does not show credentials being sent to an unrelated host.
Evidence
.taskless/.cache/temporary install directory/.npmrc
Network endpoints4
app.taskless.ioregistry.npmjs.orgus.i.posthog.comus-assets.i.posthog.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install, preinstall, or postinstall hook; its scripts are build and development commands.
- The package exports dist/index.js as its CLI entry point.
- The embedded launcher template describes installing the project-pinned Taskless CLI on first run, then running it from the project cache.
- The launcher copies the project .npmrc into a temporary install directory for npm, then removes that copy after npm ci.
- That npm ci invocation disables package scripts, audit, and funding requests.
- The launcher starts the cached CLI with the user's arguments and inherited environment.
Evidence against
Behavioral surface
ChildProcessCryptoEvalFilesystemNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
5 flaggeddist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @taskless/cli-nightly@0.13.4-20261026181356xfcb2a39
matchedIdentity = npm:QHRhc2tsZXNzL2NsaS1uaWdodGx5:0.13.4-20261026181356xfcb2a39
similarity = 0.571
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg10import { AsyncLocalStorage as Jm } from "node:async_hooks";
L11: import { execFile as tn, spawn as Ht } from "node:child_process";
L12: import { R as te, T as yf, E as Ue, a as Je, b as ve, L as Te, i as nn } from "./index-QQC7OE4T.js";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { readFile as C, mkdir as q, writeFile as P, rm as Q, readdir as Y, stat as de, mkdtemp as er, copyFile as $a, glob as gf, access as mf, readlink as Bm, chmod as Vm, rename ...
import Hm, { createInterface as nr } from "node:readline";
this.flushPromise = null, this.shutdownPromise = null, this.promiseQueue = new m0(), this._events = new A0(), this._isInitialized = !1, k0(t, "You must pass your PostHog project's ...
throw this.beginBackoff(), new pn(`Your project key or personal API key is invalid. Setting next polling interval to ${this.getPollingInterval()}ms. More information: https://posth...
throw this.beginB
Findings
1 Critical3 High1 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighCredential Redirect Persistencedist/index.js
HighCross File Remote Execution Contextdist/index.js
MediumNetwork
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @taskless/cli-nightly@0.13.4-20261029223938xcd2357c.
See all versions of @taskless/cli-nightly for other recorded verdicts.
- Review the evidence and your use of @taskless/cli-nightly@0.13.4-20261029223938xcd2357c before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.