tako-cli@0.3.12
Tako CLI — unified launcher for AI coding tools (Claude Code, Codex, Gemini) with multi-agent session management
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection found risky primitives, but they are consistent with the advertised AI-tool launcher/installer behavior and are user-invoked rather than hidden lifecycle execution. I did not find a concrete unrelated exfiltration endpoint, persistence mechanism, destructive action, or silent AI-agent hijack sufficient to block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs install.sh/install.ps1 or invokes the tako CLI.
Impact
Installs local runtime/tools and stores user configuration; no confirmed credential exfiltration or destructive behavior.
Mechanism
package-aligned installer and AI-tool launcher operations
AI rationale
Static inspection found risky primitives, but they are consistent with the advertised AI-tool launcher/installer behavior and are user-invoked rather than hidden lifecycle execution. I did not find a concrete unrelated exfiltration endpoint, persistence mechanism, destructive action, or silent AI-agent hijack sufficient to block.
Evidence
package.jsondist/index.jsinstall.shinstall.ps1README.md~/.tako/config.json~/.tako/tools~/.tako/cli~/.tako/bun~/.tako/bin/tako~/.claude/settings.json/usr/local/bin/tako
Network endpoints12
tako.shiroha.techapi.deepseek.comapi.deepseek.com/anthropicapi.xiaomimimo.com/anthropictoken-plan-cn.xiaomimimo.com/anthropicregistry.npmjs.orgregistry.npmmirror.comregistry.npmmirror.com/-/binary/bunbun.sh/installgithub.com/oven-sh/bun/releases/latest/downloadip-api.com/line/?fields=countryCodeipinfo.io/country
Decision evidence
public snapshotAI called this Clean at 82.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- dist/index.js reads/writes ~/.tako/config.json and can store API keys/providers.
- dist/index.js invokes Bun.spawn for installed AI clients, git statusline helpers, and runtime client/package updates.
- dist/index.js sends configured provider API keys as Bearer tokens to provider baseUrl /v1/models and announcements endpoints.
- install.sh/install.ps1 download Bun, install tako-cli, edit PATH/wrappers, and query geo-IP services.
Evidence against
- package.json has only prepublishOnly build hook; no install/postinstall consumer lifecycle execution.
- bin entrypoint is a user-invoked CLI for launching/managing Claude Code, Codex, Gemini, providers, versions, and statusline.
- Network endpoints are package-aligned: npm/npmmirror/Bun downloads, Tako proxy, DeepSeek/Xiaomi/provider APIs, update checks, telemetry/announcements.
- Credential handling appears tied to user-configured providers/subscription switching; no confirmed harvesting to unrelated attacker endpoint.
- Claude settings mutation sets a statusLine command to the local tako wrapper during CLI startup, not an install-time persistence hook.
- Dangerous flags are added only from selected launch options or explicit user args, not silently forced.
Source & flagged code
8 flaggeddist/index.jsView file
2// @bun
L3: var xk=Object.create;var{getPrototypeOf:pk,defineProperty:bF,getOwnPropertyNames:e7,getOwnPropertyDescriptor:ik}=Object,AL=Object.prototype.hasOwnProperty;function BL(B){return thi...
L4: `);return{update(F){if(F===g)return;if(g=F,I)C(`\r\x1B[2K\u23F3 ${F}`);else C(`\u23F3 ${F}
...
L10: `,{mode:384})}async function oz(){let B=$L?await dz():await lz(),I;try{let C=await import("fs/promises"),g=JSON.parse(await C.readFile(vN,"utf-8"));if(g.oauthAccount&&typeof g.oaut...
L11: `)}}var kL="Claude Code-credentials",OL,SL,vN,$L;var hw=c(()=>{OL=_N(qL(),".claude"),SL=_N(OL,".credentials.json"),vN=_N(qL(),".claude.json"),$L=xz()==="darwin"});var yL={};F0(yL,{...
L12:
...
L22: 3. You might have more than one copy of React in the same app
L23: See https://react.dev/link/invalid-hook-c
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L22Trigger-reachable chain: manifest.bin -> dist/index.js
L2: // @bun
L3: var xk=Object.create;var{getPrototypeOf:pk,defineProperty:bF,getOwnPropertyNames:e7,getOwnPropertyDescriptor:ik}=Object,AL=Object.prototype.hasOwnProperty;function BL(B){return thi...
L4: `);return{update(F){if(F===g)return;if(g=F,I)C(`\r\x1B[2K\u23F3 ${F}`);else C(`\u23F3 ${F}
...
L10: `,{mode:384})}async function oz(){let B=$L?await dz():await lz(),I;try{let C=await import("fs/promises"),g=JSON.parse(await C.readFile(vN,"utf-8"));if(g.oauthAccount&&typeof g.oaut...
L11: `)}}var kL="Claude Code-credentials",OL,SL,vN,$L;var hw=c(()=>{OL=_N(qL(),".claude"),SL=_N(OL,".credentials.json"),vN=_N(qL(),".claude.json"),$L=xz()==="darwin"});var yL={};F0(yL,{...
L12:
...
L22: 3. You might have more than one copy of React in the
Findings
2 Critical5 High5 Medium6 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighRuntime Package Installdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
Low
Affected versions and remediation
This report applies to tako-cli@0.3.12.
See all versions of tako-cli for other recorded verdicts.
- Review the evidence and your use of tako-cli@0.3.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.