tako-cli@0.3.11
Tako CLI — unified launcher for AI coding tools (Claude Code, Codex, Gemini) with multi-agent session management
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection confirms risky primitives, but they support the advertised AI coding tool launcher and installer workflows and are not tied to install-time execution or covert exfiltration. Scanner credential-exfiltration hints appear to be provider API use, subscription detection, and telemetry rather than concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs install.sh/install.ps1 or the tako CLI.
Impact
Local ~/.tako and AI-tool configuration may be updated; configured provider credentials may be used for intended API calls.
Mechanism
AI-tool launcher with local config, subprocess launches, installer wrappers, provider API calls, and telemetry.
AI rationale
Static inspection confirms risky primitives, but they support the advertised AI coding tool launcher and installer workflows and are not tied to install-time execution or covert exfiltration. Scanner credential-exfiltration hints appear to be provider API use, subscription detection, and telemetry rather than concrete malicious behavior.
Evidence
package.jsondist/index.jsinstall.shinstall.ps1~/.tako/config.json~/.tako/tools~/.tako/cli~/.tako/bin/tako~/.claude/settings.json~/.claude/.credentials.json~/.codex/auth.jsonshell profile PATH files
Network endpoints12
tako.shiroha.techop.shiroha.tech/apiapi.openpanel.devregistry.npmjs.orgregistry.npmmirror.combun.sh/installgithub.com/oven-sh/bun/releases/latest/downloadapi.deepseek.comapi.xiaomimimo.com/anthropictoken-plan-cn.xiaomimimo.com/anthropicapi.anthropic.com/api/oauth/usagechatgpt.com/backend-api/wham/usage
Decision evidence
public snapshotAI called this Clean at 83.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- dist/index.js reads Claude/Codex auth files or keychain to detect subscription providers, but stores them locally for provider switching.
- dist/index.js sends telemetry to https://op.shiroha.tech/api with version/platform and possibly provider email when telemetry is enabled.
- dist/index.js can install/update CLI/tools with Bun and can add opt-in dangerous flags for Claude/Codex launches.
Evidence against
- package.json has no install/postinstall hook; only prepublishOnly build script is publisher-side.
- bin entrypoint is a user-invoked CLI for launching/managing AI coding tools, matching package description.
- API keys are sent as Authorization only to configured provider/model/quota/announcement endpoints, not arbitrary hidden hosts.
- Installers download Bun/tako-cli and edit PATH/wrappers under ~/.tako or shell profiles, consistent with a CLI installer.
- Claude settings statusLine write points to local ~/.tako/bin/tako statusline and is runtime feature-aligned, not install-time hijack.
- No destructive filesystem behavior, persistence outside CLI wrappers/PATH, or hidden payload decoding found.
Source & flagged code
8 flaggeddist/index.jsView file
2// @bun
L3: var{defineProperty:oe,getOwnPropertyNames:Yt,getOwnPropertyDescriptor:Zt}=Object,Tt=Object.prototype.hasOwnProperty;function It(i){return this[i]}var Ot=(i)=>{var o=(B0??=new WeakM...
L4: `);return{update(d){if(d===e)return;if(e=d,o)n(`\r\x1B[2K\u23F3 ${d}`);else n(`\u23F3 ${d}
...
L10: `,{mode:384})}async function Ea(){let i=ld?await Xa():await Va(),o;try{let n=await import("fs/promises"),e=JSON.parse(await n.readFile(Ge,"utf-8"));if(e.oauthAccount&&typeof e.oaut...
L11: `)}}var ad="Claude Code-credentials",pd,cd,Ge,ld;var vn=G(()=>{pd=Me(td(),".claude"),cd=Me(pd,".credentials.json"),Ge=Me(td(),".claude.json"),ld=Ta()==="darwin"});var md={};ai(md,{...
L12: ? ${i.message} ${n} `);let e=await Ld((d)=>{if(d==="\r"||d===`
...
L23: `)return!0;if(n==="\x1B"||n==="q"||n==="Q")ret
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L22Trigger-reachable chain: manifest.bin -> dist/index.js
L2: // @bun
L3: var{defineProperty:oe,getOwnPropertyNames:Yt,getOwnPropertyDescriptor:Zt}=Object,Tt=Object.prototype.hasOwnProperty;function It(i){return this[i]}var Ot=(i)=>{var o=(B0??=new WeakM...
L4: `);return{update(d){if(d===e)return;if(e=d,o)n(`\r\x1B[2K\u23F3 ${d}`);else n(`\u23F3 ${d}
...
L10: `,{mode:384})}async function Ea(){let i=ld?await Xa():await Va(),o;try{let n=await import("fs/promises"),e=JSON.parse(await n.readFile(Ge,"utf-8"));if(e.oauthAccount&&typeof e.oaut...
L11: `)}}var ad="Claude Code-credentials",pd,cd,Ge,ld;var vn=G(()=>{pd=Me(td(),".claude"),cd=Me(pd,".credentials.json"),Ge=Me(td(),".claude.json"),ld=Ta()==="darwin"});var md={};ai(md,{...
L12: ? ${i.message} ${n} `);let e=await Ld((d)=>{if(d==="\r"||d===`
Findings
2 Critical5 High5 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighRuntime Package Installdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
Low
Affected versions and remediation
This report applies to tako-cli@0.3.11.
See all versions of tako-cli for other recorded verdicts.
- Review the evidence and your use of tako-cli@0.3.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.