tako-cli@0.3.40
Tako CLI — unified launcher for AI coding tools (Claude Code, Codex, Pi, Gemini, Grok Build) with multi-agent session management
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no registry install hook or self-dependency chain, so the source does not establish malicious install behavior. Its automatic foreign AI-tool configuration and fixed-endpoint credential submission remain sufficient risk to warn users.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Run tako without a command that exits earlier, or configure a Tako API key.
Impact
Changes a foreign AI tool's settings and exposes a supplied service credential to the service endpoint.
Mechanism
Automatic Claude status-line configuration and API-key submission to a fixed proxy service.
AI rationale
The package has no registry install hook or self-dependency chain, so the source does not establish malicious install behavior. Its automatic foreign AI-tool configuration and fixed-endpoint credential submission remain sufficient risk to warn users.
Evidence
dist/index.js~/.claude/settings.json~/.tako/config.json
Network endpoints1
tako.shiroha.tech
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Running the CLI automatically installs a Tako command as Claude's status line.
- The key-validation request sends the supplied API key to the fixed Tako service.
- The package persists its proxy URL and API key in its own configuration.
Evidence against
- package.json has no install-time lifecycle hook; prepublishOnly only builds before publication.
- The network and configuration actions are reached through the user-invoked CLI, not installation or import.
- No runtime dependency on another release of tako-cli is declared.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
WildcardDependency
Source & flagged code
11 flaggeddist/index.jsView file
2Source sends the broad process environment to a literal external destination.
L2: // @bun
L3: var n3=Object.create;var{getPrototypeOf:o3,defineProperty:Nc,getOwnPropertyNames:fS,getOwnPropertyDescriptor:i3}=Object,gS=Object.prototype.hasOwnProperty;function mS(e){return thi...
L4: `).map((a)=>a.trim().replace(/\r$/,"")).filter(Boolean);if(o!=="win32")return i[0];return i.find((a)=>a.toLowerCase().endsWith(".exe"))??i.find((a)=>a.toLowerCase().endsWith(".cmd"...
...
L266: * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
L267: */});function v3(e){let o=[];for(let[i,a]of Object.entries(e)){if(!a?.models)continue;for(let[s,u]of Object.entries(a.models)){let d=u?.limit?.context;if(typeof d!=="number"||d<=0)...
L268: `);else await Bun.write(LS,JSON.stringify({OPENAI_API_KEY
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L22// @bun
L3: var n3=Object.create;var{getPrototypeOf:o3,defineProperty:Nc,getOwnPropertyNames:fS,getOwnPropertyDescriptor:i3}=Object,gS=Object.prototype.hasOwnProperty;function mS(e){return thi...
L4: `).map((a)=>a.trim().replace(/\r$/,"")).filter(Boolean);if(o!=="win32")return i[0];return i.find((a)=>a.toLowerCase().endsWith(".exe"))??i.find((a)=>a.toLowerCase().endsWith(".cmd"...
...
L266: * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
L267: */});function v3(e){let o=[];for(let[i,a]of Object.entries(e)){if(!a?.models)continue;for(let[s,u]of Object.entries(a.models)){let d=u?.limit?.context;if(typeof d!=="number"||d<=0)...
L268: `);else await Bun.write(LS,JSON.stringify({OPENAI_API_KEY:null,auth_mode:"chatgpt"},null,2)+`
L269: `);else{let s;if(e.type==="tako")s=
Findings
3 Critical7 High5 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighRuntime Package Installdist/index.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to tako-cli@0.3.40.
See all versions of tako-cli for other recorded verdicts.
- Review the evidence and your use of tako-cli@0.3.40 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.