Loading npm security reports…
Desktop cockpit for orchestrating a team of Claude Code agents (Windows + macOS). Install globally: npm i -g agent-takkub
No confirmed attack was identified. Inspected installation behavior provisions the application, while reviewed runtime credential requests use the intended service and remote control defaults to disabled.
The AI recommended clean. Static policy retained a warning. The static scanner classified the package as malicious with confidence of at least 85%. A critical static finding has confidence of at least 90%. These conditions do not mean that the AI confirmed malicious behavior.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
npm/scripts/postinstall.jsView on unpkg · L1Package ships high-entropy non-source blobs.
dist/agent_takkub-2.1.48-py3-none-any.whlView on unpkgPackage ships compressed or archive-like blobs.
dist/agent_takkub-2.1.48-py3-none-any.whlView on unpkgPackage ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
dist/agent_takkub-2.1.48-py3-none-any.whlView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
npm/scripts/lib.js#virtual:normalized:round1View on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
npm/scripts/shortcut.jsView on unpkgThis report applies to agent-takkub@2.1.48.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L29Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L29Package ships high-entropy non-source blobs.
dist/agent_takkub-2.1.48-py3-none-any.whlView on unpkgPackage ships compressed or archive-like blobs.
dist/agent_takkub-2.1.48-py3-none-any.whlView on unpkgPackage ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
dist/agent_takkub-2.1.48-py3-none-any.whlView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
npm/scripts/lib.js#virtual:normalized:round1View on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
npm/scripts/shortcut.jsView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
npm/scripts/postinstall.jsView on unpkg · L1