Loading npm security reports…
Desktop cockpit for orchestrating a team of Claude Code agents (Windows + macOS). Install globally: npm i -g agent-takkub
LPM flags this version as an AI-agent control-surface risk. Installing the package automatically installs a foreign AI-agent CLI globally if missing, alters persistent PATH configuration, and creates desktop launchers. On macOS it removes and replaces an existing application bundle in the user Applications directory.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
npm/scripts/postinstall.jsView on unpkg · L1Package ships high-entropy non-source blobs.
dist/agent_takkub-2.1.5-py3-none-any.whlView on unpkgPackage ships compressed or archive-like blobs.
dist/agent_takkub-2.1.5-py3-none-any.whlView on unpkgPackage ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
dist/agent_takkub-2.1.5-py3-none-any.whlView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
npm/scripts/lib.js#virtual:normalized:round1View on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
npm/scripts/shortcut.jsView on unpkgThis report applies to agent-takkub@2.1.5.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L29Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L29Package ships high-entropy non-source blobs.
dist/agent_takkub-2.1.5-py3-none-any.whlView on unpkgPackage ships compressed or archive-like blobs.
dist/agent_takkub-2.1.5-py3-none-any.whlView on unpkgPackage ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
dist/agent_takkub-2.1.5-py3-none-any.whlView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
npm/scripts/lib.js#virtual:normalized:round1View on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
npm/scripts/shortcut.jsView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
npm/scripts/postinstall.jsView on unpkg · L1