Loading npm security reports…

agent-takkub@2.1.31: Suspicious npm security report (Warn) | LPM Firewall

registry / agent-takkub / 2.1.31

agent-takkub@2.1.31

Desktop cockpit for orchestrating a team of Claude Code agents (Windows + macOS). Install globally: npm i -g agent-takkub

AI Security Review

scanned 16d ago · by lpm-firewall-ai

Install-time code provisions an isolated home venv from a binary wheel, may globally install the Claude Code CLI when that command is absent, and writes the user PATH plus a desktop launcher. The wheel bytes could not be inspected, so the code that later runs as agent_takkub is an unresolved payload.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall on install, then the agent-takkub or takkub command which spawns the venv Python module.

Impact

User home gains a cockpit venv, a PATH change, and a launcher. A machine without claude also gets that CLI installed globally. Behavior inside the wheel is unverified.

Mechanism

postinstall.py-equivalent Node script runs python -m venv, pip install of dist/agent_takkub-2.1.31-py3-none-any.whl, optional npm install -g @anthropic-ai/claude-code, PATH rc or registry append, and shortcut creation that execs python -m agent_takkub.

AI rationale

The readable installer matches a first-party cockpit bootstrap and does not show secret theft or a hidden network sink, but it automatically installs a binary wheel whose Python source could not be read. That leaves an unresolved staged payload, so the package should be warned rather than blocked.

Evidence

package.jsonnpm/scripts/postinstall.jsnpm/scripts/lib.jsnpm/scripts/pathfix.jsnpm/scripts/shortcut.jsdist/agent_takkub-2.1.31-py3-none-any.whl.agent-takkubDesktop/Takkub Cockpit.appDesktop/Takkub Cockpit.lnk

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node npm/scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node npm/scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

npm/scripts/postinstall.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L8: // • REUSES an existing cockpit venv (upgrade in place) instead of wiping it. L9: // • Does NOT touch the global claude CLI, ~/.claude plugins, or ~/.takkub L10: // config. Anything shared/missing is left for an explicit, detect-first ... L87: L88: fs.mkdirSync(agentTakkubHome(), { recursive: true }); L89: ... L116: L117: const claudeOk = ensureClaudeCli(env.claudeCli.present); L118: ... L140: } L141: console.log(' Left untouched: ~/.claude plugins, ~/.takkub config (nothing overwritten).'); L142: // #574: the migration itself never runs here (postinstall stays a plain Write operation from npm/scripts/postinstall.js: L8: // • REUSES an existing cockpit venv (upgrade in place) instead of wiping it. L9

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

npm/scripts/postinstall.jsView on unpkg · L1

dist/agent_takkub-2.1.31-py3-none-any.whlView file

•path = dist/agent_takkub-2.1.31-py3-none-any.whl kind = high_entropy_blob sizeBytes = 4981293 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/agent_takkub-2.1.31-py3-none-any.whlView on unpkg

•path = dist/agent_takkub-2.1.31-py3-none-any.whl kind = compressed_blob sizeBytes = 4981293 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/agent_takkub-2.1.31-py3-none-any.whlView on unpkg

•path = dist/agent_takkub-2.1.31-py3-none-any.whl kind = nested_archive_needs_inspection sizeBytes = 4981293 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/agent_takkub-2.1.31-py3-none-any.whlView on unpkg

npm/scripts/lib.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

npm/scripts/lib.js#virtual:normalized:round1View on unpkg

npm/scripts/shortcut.jsView file

•matchType = normalized_sha256 matchedPackage = agent-takkub@1.0.82 matchedPath = npm/scripts/shortcut.js matchedIdentity = npm:YWdlbnQtdGFra3Vi:1.0.82 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

npm/scripts/shortcut.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 4e1434cf7f50ba4b signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = agent-takkub@2.1.25 matchedPath = npm/scripts/shortcut.js matchedIdentity = npm:YWdlbnQtdGFra3Vi:2.1.25 similarity = 1.000 shingleOverlap = 8 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

npm/scripts/shortcut.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 9-49json

9 "agent-orchestration",

10 "cockpit",

11 "desktop",

12 "cli",

13 "developer-tools"

14 ],

15 "author": "takkub",

16 "repository": {

17 "type": "git",

18 "url": "git+https://github.com/takkub/agent-takkub.git"

19 },

20 "homepage": "https://github.com/takkub/agent-takkub#readme",

21 "bugs": {

22 "url": "https://github.com/takkub/agent-takkub/issues"

23 },

24 "bin": {

25 "agent-takkub": "npm/bin/agent-takkub.js",

26 "takkub": "npm/bin/takkub.js"

27 },

28 "scripts": {

29 "postinstall": "node npm/scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "prepublishOnly": "node npm/scripts/preflight-publish.js",

31 "test": "node --test npm/scripts/*.test.js"

32 },

33 "files": [

34 "npm/",

35 "!npm/scripts/*.test.js",

36 "dist/*.whl",

37 "assets/icon.ico",

38 "assets/icon.png",

39 "assets/cockpit-main.png"

40 ],

41 "os": [

42 "win32",

43 "darwin"

44 ],

45 "engines": {

46 "node": ">=18"

47 },

48 "engines-note": "This floor is for agent-takkub itself. The OPTIONAL graft code-intelligence feature (installed separately via `takkub doctor --fix`, not an npm dependency of this package) needs Node >=20 — see README's Requirements section. Not raised here because it would force the >=20 floor onto every user even though graft stays off until explicitly enabled.",

49 "license": "MIT"

npm/scripts/postinstall.jsView file

Lines 1-21javascript

1'use strict';

2// npm postinstall bootstrap for `npm install -g agent-takkub`.

3//

4// SAFETY MODEL — check first, never clobber:

5// • Detects what's already present (preflight.js, non-mutating) and REPORTS it.

6// • Provisions ONLY into the isolated AGENT_TAKKUB_HOME (default

7// ~/.agent-takkub) — never a repo `.venv`, never shared user state.

8// • REUSES an existing cockpit venv (upgrade in place) instead of wiping it.

9// • Does NOT touch the global claude CLI, ~/.claude plugins, or ~/.takkub

10

dist/agent_takkub-2.1.31-py3-none-any.whlView file

•path = dist/agent_takkub-2.1.31-py3-none-any.whl kind = high_entropy_blob sizeBytes = 4981293 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/agent_takkub-2.1.31-py3-none-any.whlView on unpkg

•path = dist/agent_takkub-2.1.31-py3-none-any.whl kind = compressed_blob sizeBytes = 4981293 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/agent_takkub-2.1.31-py3-none-any.whlView on unpkg

•path = dist/agent_takkub-2.1.31-py3-none-any.whl kind = nested_archive_needs_inspection sizeBytes = 4981293 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/agent_takkub-2.1.31-py3-none-any.whlView on unpkg

npm/scripts/lib.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

npm/scripts/lib.js#virtual:normalized:round1View on unpkg

npm/scripts/shortcut.jsView file

•matchType = normalized_sha256 matchedPackage = agent-takkub@1.0.82 matchedPath = npm/scripts/shortcut.js matchedIdentity = npm:YWdlbnQtdGFra3Vi:1.0.82 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

npm/scripts/shortcut.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 4e1434cf7f50ba4b signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = agent-takkub@2.1.25 matchedPath = npm/scripts/shortcut.js matchedIdentity = npm:YWdlbnQtdGFra3Vi:2.1.25 similarity = 1.000 shingleOverlap = 8 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

npm/scripts/shortcut.jsView on unpkg