tako-cli@0.3.41
Tako CLI — unified launcher for AI coding tools (Claude Code, Codex, Pi, Gemini, Grok Build) with multi-agent session management
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is an explicit-user-command agent configuration capability rather than demonstrated malware. A warning is appropriate because it writes AI-agent authentication configuration, while no install hook or confirmed exfiltration was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user selects a provider and launches it through the CLI.
Impact
This changes local AI-agent configuration and can place selected credentials in Codex's local auth store; no exfiltration was confirmed.
Mechanism
The launch flow calls provider configuration code, which writes Codex configuration and authentication data.
AI rationale
This is an explicit-user-command agent configuration capability rather than demonstrated malware. A warning is appropriate because it writes AI-agent authentication configuration, while no install hook or confirmed exfiltration was found.
Evidence
dist/index.js.codex/auth.json.codex/config.toml
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest exposes a CLI entry point and its inspected scripts contain no install lifecycle hook.
- The Codex setup routine creates its configuration directory and writes supplied authentication data to the Codex auth file.
- The launch path invokes a selected provider's configuration setup before starting it.
Evidence against
- No install-time execution or confirmed credential transmission to a remote endpoint was found in the inspected paths.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
WildcardDependency
Source & flagged code
14 flaggeddist/index.jsView file
2Source sends the broad process environment to a literal external destination.
L2: // @bun
L3: var BM=Object.create;var{getPrototypeOf:yM,defineProperty:Hv,getOwnPropertyNames:DM}=Object;var Pv=Object.prototype.hasOwnProperty;function QM(e){return this[e]}var wM,vM,Be=(e,o,i...
L4: `).map((a)=>a.trim().replace(/\r$/,"")).filter(Boolean);if(o!=="win32")return i[0];return i.find((a)=>a.toLowerCase().endsWith(".exe"))??i.find((a)=>a.toLowerCase().endsWith(".cmd"...
...
L266: * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
L267: */});function PM(e){let o=[];for(let[i,a]of Object.entries(e)){if(!a?.models)continue;for(let[s,u]of Object.entries(a.models)){let d=u?.limit?.context;if(typeof d!=="number"||d<=0)...
L268: `);else await Bun.write(AS,JSON.stringify({OPENAI_API_KEY
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L22// @bun
L3: var BM=Object.create;var{getPrototypeOf:yM,defineProperty:Hv,getOwnPropertyNames:DM}=Object;var Pv=Object.prototype.hasOwnProperty;function QM(e){return this[e]}var wM,vM,Be=(e,o,i...
L4: `).map((a)=>a.trim().replace(/\r$/,"")).filter(Boolean);if(o!=="win32")return i[0];return i.find((a)=>a.toLowerCase().endsWith(".exe"))??i.find((a)=>a.toLowerCase().endsWith(".cmd"...
...
L266: * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
L267: */});function PM(e){let o=[];for(let[i,a]of Object.entries(e)){if(!a?.models)continue;for(let[s,u]of Object.entries(a.models)){let d=u?.limit?.context;if(typeof d!=="number"||d<=0)...
L268: `);else await Bun.write(AS,JSON.stringify({OPENAI_API_KEY:null,auth_mode:"chatgpt"},null,2)+`
L269: `);else{let s;if(e.type==="tako")s=
Findings
4 Critical9 High5 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
High
Affected versions and remediation
This report applies to tako-cli@0.3.41.
See all versions of tako-cli for other recorded verdicts.
- Review the evidence and your use of tako-cli@0.3.41 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.