registry  /  @taskless/cli  /  0.10.0

@taskless/cli@0.10.0

> A Work in Progress

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
Supply chain
HighEntropyStringsTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 670 KB of source, external domains: app.taskless.io, ast-grep.github.io, docs.rs, eu-assets.i.posthog.com, eu.i.posthog.com, github.com, json-schema.org, posthog.com, raw.githubusercontent.com, taskless.io, us-assets.i.posthog.com, us.i.posthog.com, yandex.com, z.taskless.io

Source & flagged code

3 flagged · loading source
dist/index.jsView file
4import { existsSync as fs, readFileSync as El, createReadStream as sp, globSync as rp } from "node:fs"; L5: import { execFile as fi, spawn as ln } from "node:child_process"; L6: import { homedir as ip, tmpdir as Tl } from "node:os"; ... L14: import { styleText as T } from "node:util"; L15: import be, { stdout as xl, stdin as mp } from "node:process"; L16: const he = { ... L452: platform: Sp = "" L453: } = typeof process > "u" ? {} : process, $p = "NO_COLOR" in Ye || Fl.includes("--no-color"), Ip = "FORCE_COLOR" in Ye || Fl.includes("--color"), Ep = Sp === "win32", Nl = Ye.TERM =... L454: function Pl(e, t, n, s, r = t.slice(0, Math.max(0, e)) + s, i = t.slice(Math.max(0, e + n.length)), o = i.indexOf(n)) { ... L623: } L624: for (c = 0; c < r.length && r.charCodeAt(c) === 45; c++) L625: ;
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L4
14427const matches = JSON.parse(readFileSync(matchesPath, "utf8")); L14428: const mod = await import(pathToFileURL(checkFile).href); L14429: const check = mod.default;
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L14427
17028"severity": "error", L17029: "message": "Avoid eval()", L17030: "note": null,
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L17028

Findings

1 High4 Medium6 Low
HighObfuscated Payload Loaderdist/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/index.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings