@taskless/cli@0.13.1

⚠ Under review

[![npm](https://img.shields.io/npm/v/@taskless/cli)](https://www.npmjs.com/package/@taskless/cli) [![build](https://img.shields.io/github/actions/workflow/status/taskless/cli/validate.yml?branch=main)](https://github.com/taskless/cli/actions/workflows/val

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEvalFilesystemNetwork

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 1.20 MB of source, external domains: app.taskless.io, ast-grep.github.io, docs.rs, docs.vale.sh, eu-assets.i.posthog.com, eu.i.posthog.com, example.com, github.com, json-schema.org, posthog.com, raw.githubusercontent.com, taskless.io, tskl.es, us-assets.i.posthog.com, us.i.posthog.com, www.taskless.io, yandex.com, z.taskless.io

Source & flagged code

2 flagged

dist/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { readFile as x, mkdir as G, writeFile as B, rm as oe, readdir as X, stat as $e, mkdtemp as No, copyFile as iu, glob as ru, access as Hp, readlink as Jp, rename as rt, cp as... import { createReadStream as tg, globSync as Lo, readdirSync as ng, existsSync as Wn, readFileSync as ou, rmSync as au, mkdtempSync as sg, writeFileSync as ig } from "node:fs"; import rg, { createInterface as es } from "node:readline"; this.flushPromise = null, this.shutdownPromise = null, this.promiseQueue = new Ty(), this._events = new Py(), this._isInitialized = !1, Ny(t, "You must pass your PostHog project's ... throw this.beginBackoff(

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @taskless/cli@0.13.0 matchedIdentity = npm:QHRhc2tsZXNzL2NsaQ:0.13.0 similarity = 0.929 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Findings

2 High1 Medium6 Low

HighCredential Redirect Persistencedist/index.js

HighPrevious Version Dangerous Deltadist/index.js

MediumNetwork

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to @taskless/cli@0.13.1.

See all versions of @taskless/cli for other recorded verdicts.

Review the evidence and your use of @taskless/cli@0.13.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 08:55:10.517Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @taskless/cli / 0.13.1

@taskless/cli@0.13.1

⚠ Under review

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEvalFilesystemNetwork

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

2 flagged

dist/index.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Findings

2 High1 Medium6 Low

HighCredential Redirect Persistencedist/index.js

HighPrevious Version Dangerous Deltadist/index.js

MediumNetwork

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to @taskless/cli@0.13.1.

See all versions of @taskless/cli for other recorded verdicts.

Review the evidence and your use of @taskless/cli@0.13.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 08:55:10.517Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.