tako-cli@0.3.29
Tako CLI — unified launcher for AI coding tools (Claude Code, Codex, Gemini) with multi-agent session management
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNo malicious npm install-time behavior or confirmed secret/file exfiltration was found. Default telemetry plus explicit cross-client credential/configuration mutation is a meaningful capability that warrants warning rather than blocking.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Run the installer or invoke tako to configure/launch a client.
Impact
Can alter AI-client configuration and transmit telemetry identifiers to the package service.
Mechanism
Explicit launcher configuration, runtime installation, and telemetry.
AI rationale
No malicious npm install-time behavior or confirmed secret/file exfiltration was found. Default telemetry plus explicit cross-client credential/configuration mutation is a meaningful capability that warrants warning rather than blocking.
Evidence
package.jsondist/index.jsinstall.shinstall.ps1~/.tako/config.json~/.codex/config.toml~/.codex/auth.json~/.claude/settings.json~/.claude/.credentials.json~/.gemini/settings.json.claude/skills/
Network endpoints4
op.shiroha.tech/apitako.shiroha.techregistry.npmjs.orgregistry.npmmirror.com
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/index.js sends telemetry, including configured provider email/ID, to https://op.shiroha.tech/api by default.
- dist/index.js writes ~/.codex/config.toml and auth.json when launching Codex.
- dist/index.js writes Claude and Gemini settings/credentials during selected launcher setup.
- install.sh and install.ps1 download Bun and install packages after explicit execution.
Evidence against
- package.json has only prepublishOnly; npm installation has no install lifecycle hook.
- AI-agent configuration changes occur from user-invoked launcher commands, not package installation.
- No source path found that harvests arbitrary environment secrets or exfiltrates local files.
- Skill installation is an explicit command and writes only beneath the current project's .claude/skills.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
9 flaggeddist/index.jsView file
2// @bun
L3: var mk=Object.create;var{getPrototypeOf:_k,defineProperty:Cw,getOwnPropertyNames:M7,getOwnPropertyDescriptor:Tk}=Object,L7=Object.prototype.hasOwnProperty;function J7(A){return thi...
L4: * Copyright (c) Squirrel Chat et al., All rights reserved.
...
L265: * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
L266: */});function A$(A){let I=[];for(let[E,g]of Object.entries(A)){if(!g?.models)continue;for(let[D,w]of Object.entries(g.models)){let N=w?.limit?.context;if(typeof N!=="number"||N<=0)...
L267: `);else await Bun.write(f7,JSON.stringify({OPENAI_API_KEY:null,auth_mode:"chatgpt"},null,2)+`
L268: `);else{let D;if(A.type==="tako")D=`${wI}/v1`;else if(A.type==="deepseek")D="https://api.deepseek.com/v1";else D=`${A.baseUrl}/v1`;let N=I?.find((q)=>q.startsWi
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L22Trigger-reachable chain: manifest.bin -> dist/index.js
L2: // @bun
L3: var mk=Object.create;var{getPrototypeOf:_k,defineProperty:Cw,getOwnPropertyNames:M7,getOwnPropertyDescriptor:Tk}=Object,L7=Object.prototype.hasOwnProperty;function J7(A){return thi...
L4: * Copyright (c) Squirrel Chat et al., All rights reserved.
...
L265: * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
L266: */});function A$(A){let I=[];for(let[E,g]of Object.entries(A)){if(!g?.models)continue;for(let[D,w]of Object.entries(g.models)){let N=w?.limit?.context;if(typeof N!=="number"||N<=0)...
L267: `);else await Bun.write(f7,JSON.stringify({OPENAI_API_KEY:null,auth_mode:"chatgpt"},null,2)+`
L268: `);else{let D;if(A.type==="tako")D=`${wI}/v1`;else if(A.type==="deepseek")D="https://api.deepseek.com/v1"
Findings
2 Critical6 High5 Medium6 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighRuntime Package Installdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
Low
Affected versions and remediation
This report applies to tako-cli@0.3.29.
See all versions of tako-cli for other recorded verdicts.
- Review the evidence and your use of tako-cli@0.3.29 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.