registry / @doist/comms-cli / 1.9.3

@doist/comms-cli@1.9.3

TypeScript CLI for Comms

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 120 file(s), 419 KB of source, external domains: api.comms.todoist.com, comms.local.todoist.com, comms.staging.todoist.com, comms.todoist.com, github.com, local.todoist.com, raw.githubusercontent.com, staging.todoist.com, todoist.com, twist.com, www.w3.org

Source & flagged code

3 flagged

package.jsonView file

Lines 1-37json

2 "name": "@doist/comms-cli",

3 "version": "1.9.3",

4 "description": "TypeScript CLI for Comms",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "tdc": "dist/index.js"

9 },

10 "scripts": {

11 "build": "tsc -p tsconfig.build.json && chmod +x dist/index.js",

12 "dev": "tsc -p tsconfig.build.json --watch",

13 "start": "node dist/index.js",

14 "type-check": "tsc --noEmit",

15 "lint": "oxlint . --fix && oxfmt",

16 "lint:check": "oxlint . && oxfmt --check",

17 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "check:skill-sync": "node scripts/check-skill-sync.js",

19 "sync:skill": "npm run build && node scripts/sync-skill.js",

20 "test": "vitest run",

21 "test:watch": "vitest",

22 "prepublishOnly": "npm run build && npm test"

23 },

24 "keywords": [

25 "comms",

26 "cli",

27 "messaging",

28 "doist"

29 ],

30 "author": "Doist developers",

31 "license": "MIT",

32 "engines": {

33 "node": "^20.19.0 || >=22.12.0"

34 },

35 "repository": {

36 "type": "git",

37 "url": "https://github.com/Doist/comms-cli.git"

scripts/check-skill-sync.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

3/**

4 * Verifies that skills/comms-cli/SKILL.md is in sync with the generated

5 * skill content from src/lib/skills/content.ts.

6 *

7 * Requires `npm run build` to have been run first.

8 */

10import { readFile } from 'node:fs/promises'

Source & flagged code

3 flagged · loading source

package.jsonView file

@doist/comms-cli@1.9.3

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code