tako-cli@0.3.44
Tako CLI — unified launcher for AI coding tools (Claude Code, Codex, Pi, Gemini, Grok Build) with multi-agent session management
AI Security Review
scanned 1mo ago · by lpm-firewall-aitako-cli is a user-invoked launcher whose package.json has no install lifecycle hook and no self-dependency. The Codex config writer at the hinted site is reached from explicit launch and provider binding, which matches the stated product and leaves no concrete attack chain.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs the tako binary or chooses a client or provider in its interface.
Impact
No unconsented install mutation, credential theft, or remote payload execution was established.
Mechanism
The CLI installs or launches third-party coding agents and writes their local config to the user-selected provider endpoint.
AI rationale
tako-cli is a user-invoked launcher whose package.json has no install lifecycle hook and no self-dependency. The Codex config writer at the hinted site is reached from explicit launch and provider binding, which matches the stated product and leaves no concrete attack chain.
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes only the tako bin at dist/index.js and has no preinstall, install, or postinstall hook, and dependencies do not include tako-cli.
- The hinted dist/index.js site registers the Codex client and its setupConfigFiles writer for ~/.codex/config.toml and auth.json.
- That writer runs from the explicit launch path with forLaunch set, after the user starts tako or selects a client, and points the provider base URL at the configured Tako, DeepSeek, or custom endpoint.
Evidence against
- Default-on telemetry can send the configured provider email and profile id to OpenPanel when telemetryEnabled is not false.
- Launch and provider-bind commands rewrite local Claude, Codex, Pi, Gemini, and Grok settings so those tools use the chosen gateway.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
14 flaggeddist/index.jsView file
2Source sends the broad process environment to a literal external destination.
L2: // @bun
L3: var kM=Object.create;var{getPrototypeOf:LM,defineProperty:Kv,getOwnPropertyNames:MM}=Object;var Yv=Object.prototype.hasOwnProperty;function _M(e){return this[e]}var OM,UM,Be=(e,o,i...
L4: `).map((a)=>a.trim().replace(/\r$/,"")).filter(Boolean);if(o!=="win32")return i[0];return i.find((a)=>a.toLowerCase().endsWith(".exe"))??i.find((a)=>a.toLowerCase().endsWith(".cmd"...
...
L266: * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
L267: */});function t_(e){let o=[];for(let[i,a]of Object.entries(e)){if(!a?.models)continue;for(let[s,u]of Object.entries(a.models)){let d=u?.limit?.context;if(typeof d!=="number"||d<=0)...
L268: `);else await Bun.write(dS,JSON.stringify({OPENAI_API_KEY
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L22// @bun
L3: var kM=Object.create;var{getPrototypeOf:LM,defineProperty:Kv,getOwnPropertyNames:MM}=Object;var Yv=Object.prototype.hasOwnProperty;function _M(e){return this[e]}var OM,UM,Be=(e,o,i...
L4: `).map((a)=>a.trim().replace(/\r$/,"")).filter(Boolean);if(o!=="win32")return i[0];return i.find((a)=>a.toLowerCase().endsWith(".exe"))??i.find((a)=>a.toLowerCase().endsWith(".cmd"...
...
L266: * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
L267: */});function t_(e){let o=[];for(let[i,a]of Object.entries(e)){if(!a?.models)continue;for(let[s,u]of Object.entries(a.models)){let d=u?.limit?.context;if(typeof d!=="number"||d<=0)...
L268: `);else await Bun.write(dS,JSON.stringify({OPENAI_API_KEY:null,auth_mode:"chatgpt"},null,2)+`
L269: `);else{let s;if(e.type==="tako")s=
Findings
4 Critical9 High5 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
High
Affected versions and remediation
This report applies to tako-cli@0.3.44.
See all versions of tako-cli for other recorded verdicts.
- Review the evidence and your use of tako-cli@0.3.44 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.