tako-cli@0.3.43
Tako CLI — unified launcher for AI coding tools (Claude Code, Codex, Pi, Gemini, Grok Build) with multi-agent session management
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package has a guarded, user-invoked capability to alter a separate AI agent's configuration and authentication files. This warrants a warning under the agent integration policy, but the inspected source does not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user launches a configured Codex provider through the Tako launcher.
Impact
This is an explicit agent-configuration capability that can change Codex settings and credentials, but no covert exfiltration or automatic installation trigger was found.
Mechanism
The launcher calls the provider setup routine with a launch flag; that routine reads and writes Codex configuration and may write supplied authentication data.
AI rationale
The package has a guarded, user-invoked capability to alter a separate AI agent's configuration and authentication files. This warrants a warning under the agent integration policy, but the inspected source does not establish malicious behavior.
Evidence
dist/index.js.codex/config.toml.codex/auth.json
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes a command-line entrypoint and declares only a prepublish build lifecycle hook.
- The Codex provider targets .codex/config.toml and .codex/auth.json.
- When a provider is launched, the launcher invokes its configuration setup with a for-launch flag.
- The Codex setup reads configuration and can write authentication data to the Codex auth file.
Evidence against
- No install, preinstall, or postinstall hook was found.
- The configuration mutation is reached through the launcher flow, not package installation.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
WildcardDependency
Source & flagged code
13 flaggeddist/index.jsView file
2Source sends the broad process environment to a literal external destination.
L2: // @bun
L3: var bM=Object.create;var{getPrototypeOf:NM,defineProperty:zv,getOwnPropertyNames:RM}=Object;var Jv=Object.prototype.hasOwnProperty;function TM(e){return this[e]}var FM,kM,Be=(e,o,i...
L4: `).map((a)=>a.trim().replace(/\r$/,"")).filter(Boolean);if(o!=="win32")return i[0];return i.find((a)=>a.toLowerCase().endsWith(".exe"))??i.find((a)=>a.toLowerCase().endsWith(".cmd"...
...
L266: * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
L267: */});function VM(e){let o=[];for(let[i,a]of Object.entries(e)){if(!a?.models)continue;for(let[s,u]of Object.entries(a.models)){let d=u?.limit?.context;if(typeof d!=="number"||d<=0)...
L268: `);else await Bun.write(lS,JSON.stringify({OPENAI_API_KEY
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L22// @bun
L3: var bM=Object.create;var{getPrototypeOf:NM,defineProperty:zv,getOwnPropertyNames:RM}=Object;var Jv=Object.prototype.hasOwnProperty;function TM(e){return this[e]}var FM,kM,Be=(e,o,i...
L4: `).map((a)=>a.trim().replace(/\r$/,"")).filter(Boolean);if(o!=="win32")return i[0];return i.find((a)=>a.toLowerCase().endsWith(".exe"))??i.find((a)=>a.toLowerCase().endsWith(".cmd"...
...
L266: * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
L267: */});function VM(e){let o=[];for(let[i,a]of Object.entries(e)){if(!a?.models)continue;for(let[s,u]of Object.entries(a.models)){let d=u?.limit?.context;if(typeof d!=="number"||d<=0)...
L268: `);else await Bun.write(lS,JSON.stringify({OPENAI_API_KEY:null,auth_mode:"chatgpt"},null,2)+`
L269: `);else{let s;if(e.type==="tako")s=
Findings
3 Critical9 High5 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
High
Affected versions and remediation
This report applies to tako-cli@0.3.43.
See all versions of tako-cli for other recorded verdicts.
- Review the evidence and your use of tako-cli@0.3.43 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.