Loading npm security reports…

agent-takkub@1.2.1: AI-agent control-surface risk | LPM Firewall

registry / agent-takkub / 1.2.1

agent-takkub@1.2.1

Desktop cockpit for orchestrating a team of Claude Code agents (Windows + macOS). Install globally: npm i -g agent-takkub

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the npm package automatically alters persistent user shell configuration, creates desktop application files, and may globally install Claude Code. These changes affect a broad AI-agent and command-execution environment without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall during package installation

Impact

The package can add and expose an AI-agent command globally, modify shell startup behavior, and overwrite its application launcher copy.

Mechanism

Automatic global CLI installation and persistent user-environment mutation

Policy narrative

On installation, the postinstall script provisions a virtual environment, then automatically installs @anthropic-ai/claude-code globally if it is missing. It invokes pathfix to append PATH exports to shell startup files and creates a desktop launcher. On macOS it deletes and recreates the user Applications launcher copy. This is unconsented install-time mutation of a broad AI-agent control surface and persistent user environment.

AI rationale

The automatic lifecycle script installs a foreign AI-agent CLI and persistently changes user shell and application state. This concrete install-time control-surface mutation meets the blocking policy.

Evidence

package.jsonnpm/scripts/postinstall.jsnpm/scripts/pathfix.jsnpm/scripts/shortcut.js~/.zshrc~/.bashrc~/Desktop/Takkub Cockpit.app

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node npm/scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node npm/scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

npm/scripts/postinstall.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L8: // • REUSES an existing cockpit venv (upgrade in place) instead of wiping it. L9: // • Does NOT touch the global claude CLI, ~/.claude plugins, or ~/.takkub L10: // config. Anything shared/missing is left for an explicit, detect-first ... L87: L88: fs.mkdirSync(agentTakkubHome(), { recursive: true }); L89: ... L116: L117: const claudeOk = ensureClaudeCli(env.claudeCli.present); L118: ... L140: } L141: console.log(' Left untouched: ~/.claude plugins, ~/.takkub config (nothing overwritten).'); L142: console.log('\n Next steps:'); Write operation from npm/scripts/postinstall.js: L8: // • REUSES an existing cockpit venv (upgrade in place) instead of wiping it. L9: // • Does NOT touch the global claud

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

npm/scripts/postinstall.jsView on unpkg · L1

dist/agent_takkub-1.2.1-py3-none-any.whlView file

•path = dist/agent_takkub-1.2.1-py3-none-any.whl kind = high_entropy_blob sizeBytes = 4131116 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/agent_takkub-1.2.1-py3-none-any.whlView on unpkg

•path = dist/agent_takkub-1.2.1-py3-none-any.whl kind = compressed_blob sizeBytes = 4131116 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/agent_takkub-1.2.1-py3-none-any.whlView on unpkg

•path = dist/agent_takkub-1.2.1-py3-none-any.whl kind = nested_archive_needs_inspection sizeBytes = 4131116 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/agent_takkub-1.2.1-py3-none-any.whlView on unpkg

npm/scripts/lib.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

npm/scripts/lib.js#virtual:normalized:round1View on unpkg

npm/scripts/shortcut.jsView file

•matchType = normalized_sha256 matchedPackage = agent-takkub@1.5.0 matchedPath = npm/scripts/shortcut.js matchedIdentity = npm:YWdlbnQtdGFra3Vi:1.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

npm/scripts/shortcut.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 72f94b310ca40884 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = agent-takkub@1.5.0 matchedPath = npm/scripts/shortcut.js matchedIdentity = npm:YWdlbnQtdGFra3Vi:1.5.0 similarity = 1.000 shingleOverlap = 8 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

npm/scripts/shortcut.jsView on unpkg