registry / agent-takkub / 1.0.8

agent-takkub@1.0.8

Desktop cockpit for orchestrating a team of Claude Code agents (Windows + macOS)

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 19.0 KB of source, external domains: www.apple.com

Source & flagged code

6 flagged

package.jsonView file

Lines 9-47json

9 "agent-orchestration",

10 "cockpit",

11 "desktop",

12 "cli",

13 "developer-tools"

14 ],

15 "author": "takkub",

16 "repository": {

17 "type": "git",

18 "url": "git+https://github.com/takkub/agent-takkub.git"

19 },

20 "homepage": "https://github.com/takkub/agent-takkub#readme",

21 "bugs": {

22 "url": "https://github.com/takkub/agent-takkub/issues"

23 },

24 "bin": {

25 "agent-takkub": "npm/bin/agent-takkub.js",

26 "takkub": "npm/bin/takkub.js"

27 },

28 "scripts": {

29 "postinstall": "node npm/scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 },

31 "files": [

32 "npm/",

33 "dist/*.whl",

34 "assets/icon.ico",

35 "assets/icon.png",

36 "assets/cockpit-main.png"

37 ],

38 "os": [

39 "win32",

40 "darwin"

41 ],

42 "engines": {

43 "node": ">=18"

44 },

45 "license": "MIT"

46}

npm/scripts/pathfix.jsView file

Lines 1-31javascript

1'use strict';

2// Ensure the npm global bin dir stays on the user's persistent PATH.

3//

4// Field incident 2026-07-04: a Node update dropped %APPDATA%\npm from the user

5// PATH — `claude`, `takkub`, and `agent-takkub` all became "command not found"

6// and the user had to hand-edit the registry. This module makes the install

7// self-healing:

8// • win32 — appends the dir to HKCU\Environment Path via .NET RegistryKey,

9// PRESERVING the value kind (REG_SZ vs REG_EXPAND_SZ, read with

10// DoNotExpandEnvironmentNames so %VAR% entries survive verbatim),

dist/agent_takkub-1.0.8-py3-none-any.whlView file

•path = dist/agent_takkub-1.0.8-py3-none-any.whl kind = high_entropy_blob sizeBytes = 681280 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/agent_takkub-1.0.8-py3-none-any.whlView on unpkg

•path = dist/agent_takkub-1.0.8-py3-none-any.whl kind = compressed_blob sizeBytes = 681280 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/agent_takkub-1.0.8-py3-none-any.whlView on unpkg

•path = dist/agent_takkub-1.0.8-py3-none-any.whl kind = nested_archive_needs_inspection sizeBytes = 681280 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/agent_takkub-1.0.8-py3-none-any.whlView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node npm/scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node npm/scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

npm/scripts/pathfix.jsView file

11// then broadcasts WM_SETTINGCHANGE so new shells see it. L12: // • darwin/linux — appends a marker-guarded export block to ~/.zshrc (and L13: // ~/.bashrc when present). Idempotent via the marker. ... L16: L17: const { execFileSync, spawnSync } = require('child_process'); L18: const fs = require('fs'); ... L25: // Node ≥18 refuses to spawn .cmd shims without a shell (CVE-2024-27980 L26: // hardening) — route through cmd.exe explicitly on Windows. L27: const r = L28: process.platform === 'win32' L29: ? spawnSync('cmd.exe', ['/d', '/s', '/c', 'npm prefix -g'], { ... L34: : spawnSync('npm', ['prefix', '-g'], { encoding: 'utf8', timeout: 30000 });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

npm/scripts/pathfix.jsView on unpkg · L11

dist/agent_takkub-1.0.8-py3-none-any.whlView file

•path = dist/agent_takkub-1.0.8-py3-none-any.whl kind = high_entropy_blob sizeBytes = 681280 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/agent_takkub-1.0.8-py3-none-any.whlView on unpkg

•path = dist/agent_takkub-1.0.8-py3-none-any.whl kind = compressed_blob sizeBytes = 681280 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/agent_takkub-1.0.8-py3-none-any.whlView on unpkg

•path = dist/agent_takkub-1.0.8-py3-none-any.whl kind = nested_archive_needs_inspection sizeBytes = 681280 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/agent_takkub-1.0.8-py3-none-any.whlView on unpkg

Findings

2 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobdist/agent_takkub-1.0.8-py3-none-any.whl

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumInstall Persistencenpm/scripts/pathfix.js

MediumShips Compressed Blobdist/agent_takkub-1.0.8-py3-none-any.whl

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiondist/agent_takkub-1.0.8-py3-none-any.whl

Source & flagged code

6 flagged

package.jsonView file

Lines 9-47json

9 "agent-orchestration",

10 "cockpit",

11 "desktop",

12 "cli",

13 "developer-tools"

14 ],

15 "author": "takkub",

16 "repository": {

17 "type": "git",

18 "url": "git+https://github.com/takkub/agent-takkub.git"

19 },

20 "homepage": "https://github.com/takkub/agent-takkub#readme",

21 "bugs": {

22 "url": "https://github.com/takkub/agent-takkub/issues"

23 },

24 "bin": {

25 "agent-takkub": "npm/bin/agent-takkub.js",

26 "takkub": "npm/bin/takkub.js"

27 },

28 "scripts": {

29 "postinstall": "node npm/scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 },

31 "files": [

32 "npm/",

33 "dist/*.whl",

34 "assets/icon.ico",

35 "assets/icon.png",

36 "assets/cockpit-main.png"

37 ],

38 "os": [

39 "win32",

40 "darwin"

41 ],

42 "engines": {

43 "node": ">=18"

44 },

45 "license": "MIT"

46}

npm/scripts/pathfix.jsView file

Lines 1-31javascript

1'use strict';

2// Ensure the npm global bin dir stays on the user's persistent PATH.

3//

4// Field incident 2026-07-04: a Node update dropped %APPDATA%\npm from the user

5// PATH — `claude`, `takkub`, and `agent-takkub` all became "command not found"

6// and the user had to hand-edit the registry. This module makes the install

7// self-healing:

8// • win32 — appends the dir to HKCU\Environment Path via .NET RegistryKey,

9// PRESERVING the value kind (REG_SZ vs REG_EXPAND_SZ, read with

10// DoNotExpandEnvironmentNames so %VAR% entries survive verbatim),

dist/agent_takkub-1.0.8-py3-none-any.whlView file

•path = dist/agent_takkub-1.0.8-py3-none-any.whl kind = high_entropy_blob sizeBytes = 681280 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/agent_takkub-1.0.8-py3-none-any.whlView on unpkg

•path = dist/agent_takkub-1.0.8-py3-none-any.whl kind = compressed_blob sizeBytes = 681280 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/agent_takkub-1.0.8-py3-none-any.whlView on unpkg

•path = dist/agent_takkub-1.0.8-py3-none-any.whl kind = nested_archive_needs_inspection sizeBytes = 681280 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/agent_takkub-1.0.8-py3-none-any.whlView on unpkg