tako-cli@0.3.46
Tako CLI — unified launcher for AI coding tools (Claude Code, Codex, Pi, Gemini, Grok Build) with multi-agent session management
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe CLI sends default-on runtime telemetry to the vendor and may include an existing provider email alongside account and machine metadata. This supports a telemetry warning; the inspected provider configuration routes keys according to the selected provider, and no malicious credential exfiltration was established.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Starting the Tako CLI when telemetry is enabled, which is the default.
Impact
The vendor receives identifying account information without an explicit opt-in; no credential theft or unrelated account action was established.
Mechanism
The CLI identifies an analytics profile using an account ID and may include an existing provider email, region, locale, version, platform, and architecture in a request to op.shiroha.tech.
AI rationale
The CLI sends default-on runtime telemetry to the vendor and may include an existing provider email alongside account and machine metadata. This supports a telemetry warning; the inspected provider configuration routes keys according to the selected provider, and no malicious credential exfiltration was established.
Evidence
dist/index.js
Network endpoints1
op.shiroha.tech
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI entry point is dist/index.js.
- Telemetry defaults to enabled unless telemetryEnabled is explicitly false.
- At CLI startup, the package sends a cli_started event and starts telemetry identification.
- Telemetry identification can include an existing provider email, account profile ID, region, locale, version, platform, and architecture, and is sent to op.shiroha.tech.
- The source labels telemetry anonymous and provides a toggle, but its identification payload can include an email address.
Evidence against
- The only lifecycle script is prepublishOnly, which runs a build; no install hook was found.
- Provider API keys are routed according to the selected provider type, including separate DeepSeek, Xiaomi, and custom-provider settings.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
17 flaggeddist/index.jsView file
2Source sends the broad process environment to a literal external destination.
L2: // @bun
L3: var MM=Object.create;var{getPrototypeOf:_M,defineProperty:Wv,getOwnPropertyNames:OM}=Object;var jv=Object.prototype.hasOwnProperty;function UM(e){return this[e]}var GM,HM,Be=(e,o,i...
L4: `).map((a)=>a.trim().replace(/\r$/,"")).filter(Boolean);if(o!=="win32")return i[0];return i.find((a)=>a.toLowerCase().endsWith(".exe"))??i.find((a)=>a.toLowerCase().endsWith(".cmd"...
...
L266: * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
L267: */});function o_(e){let o=[];for(let[i,a]of Object.entries(e)){if(!a?.models)continue;for(let[s,u]of Object.entries(a.models)){let d=u?.limit?.context;if(typeof d!=="number"||d<=0)...
L268: `);else await Bun.write(fS,JSON.stringify({OPENAI_API_KEY
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L22// @bun
L3: var MM=Object.create;var{getPrototypeOf:_M,defineProperty:Wv,getOwnPropertyNames:OM}=Object;var jv=Object.prototype.hasOwnProperty;function UM(e){return this[e]}var GM,HM,Be=(e,o,i...
L4: `).map((a)=>a.trim().replace(/\r$/,"")).filter(Boolean);if(o!=="win32")return i[0];return i.find((a)=>a.toLowerCase().endsWith(".exe"))??i.find((a)=>a.toLowerCase().endsWith(".cmd"...
...
L266: * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
L267: */});function o_(e){let o=[];for(let[i,a]of Object.entries(e)){if(!a?.models)continue;for(let[s,u]of Object.entries(a.models)){let d=u?.limit?.context;if(typeof d!=="number"||d<=0)...
L268: `);else await Bun.write(fS,JSON.stringify({OPENAI_API_KEY:null,auth_mode:"chatgpt"},null,2)+`
L269: `);else{let s;if(e.type==="tako")s=
Findings
4 Critical12 High5 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
High
Affected versions and remediation
This report applies to tako-cli@0.3.46.
See all versions of tako-cli for other recorded verdicts.
- Review the evidence and your use of tako-cli@0.3.46 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.