Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@doist/todoist-cli@5.1.0: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged as agent extension risk

Allowed by default with warning: install-time first-party agent extension setup was detected.

View on npm All versions Policy details

registry / @doist/todoist-cli / 5.1.0

@doist/todoist-cli@5.1.0

TypeScript CLI for Todoist

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installation silently refreshes already installed Todoist skills in supported agent directories and migrates legacy Todoist authentication. No remote payload execution or broad new agent configuration creation was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm post-install execution

Impact

Existing agent skill content and legacy Todoist authentication configuration may change during installation.

Mechanism

Guarded update of existing agent skill files and legacy authentication migration

AI rationale

The install hook modifies existing agent skill files and legacy authentication state, creating a guarded extension lifecycle risk. The inspected source restricts updates to pre-existing skills and contains no remote payload fetch or unconsented broad agent configuration creation.

Evidence

package.jsonscripts/postinstall.jsdist/postinstall.jsdist/lib/skills/index.jsdist/lib/skills/create-installer.jsdist/lib/skills/update-installed.jsdist/lib/migrate-auth.js

Network endpoints1

api.todoist.com/api/v1/user

Decision evidence

Stop threats before they install.

Firewall

Threat feed
How it works
Policy

LPM

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The post-install hook updates previously installed Todoist agent skills and performs an authentication migration.
Skill installers target several agent-specific skill directories and can overwrite an existing skill file during an update.
The migration sends a legacy Todoist token to the official Todoist user endpoint to identify its account.

Evidence against

Skill updates occur only when the corresponding skill file already exists.
The agent content is generated locally from bundled static text; no remote skill payload is fetched.
Migration failures are ignored and the documented migration is limited to legacy Todoist authentication state.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 244 file(s), 757 KB of source, external domains: api.todoist.com, app.todoist.com, example.com, files.todoist.com, get.todoist.help, github.com, todoist.com, todoist.zendesk.com, www.todoist.com, www.w3.org

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/check-skill-sync.jsView file

17const modulePath = pathToFileURL(join(root, 'dist/lib/skills/create-installer.js')).href L18: const { generateSkillFile } = await import(modulePath) L19: const expected = generateSkillFile()

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/check-skill-sync.jsView on unpkg · L17

dist/lib/skills/create-installer.jsView file

99async install(local, force) { L100: if (!local && config.dirName !== '.agents') { L101: const agentDir = join(homedir(), config.dirName); ... L113: } L114: await mkdir(dirname(filepath), { recursive: true }); L115: await writeFile(filepath, this.generateContent(), 'utf-8'); ... L119: const filepath = getInstallPath(local); L120: await mkdir(dirname(filepath), { recursive: true }); L121: await writeFile(filepath, this.generateContent(), 'utf-8');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/lib/skills/create-installer.jsView on unpkg · L99

Findings

1 Critical1 High5 Medium5 Low

CriticalAi Agent Control Hijackdist/lib/skills/create-installer.js

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/check-skill-sync.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @doist/todoist-cli@5.1.0.

See version security history for other recorded verdicts.

Review the evidence and your use of @doist/todoist-cli@5.1.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-27 16:37:01.607Z (UTC).

91%Suspicious

AI assessment confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

AuthorErnesto García

Maintainersricardoist, henningmu, jvalente +9

Version5.1.0

Latest on npm5.4.9

PublishedAug 27, 2026

LicenseMIT

Dependencies11

Integrityverified

Package size366 KB

Files971

Keywordstodoistclitodotasks

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/index.jstypes → ./dist/index.d.tsbin → td

Runtimenpm >=11node >=24

Artifact1.65 MB · 971 files1 signature(s) · provenance

Install lifecyclepostinstallprepublishOnly

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkHighEntropyStringsUrlStringsManifest: clean

LPM.dev Registry

© 2026 LPM

Source & flagged code

4 flagged

package.jsonView file

Lines 1-37json

1{

2 "name": "@doist/todoist-cli",

3 "version": "5.1.0",

4 "description": "TypeScript CLI for Todoist",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "td": "dist/index.js"

9 },

10 "scripts": {

11 "build": "tsc -p tsconfig.build.json",

12 "dev": "tsc -p tsconfig.build.json --watch",

13 "start": "node dist/index.js",

14 "type-check": "tsc --noEmit",

15 "check": "oxlint src && oxfmt --check",

16 "fix": "oxlint src --fix && oxfmt",

17 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "check:skill-sync": "node scripts/check-skill-sync.js",

19 "sync:skill": "npm run build && node scripts/sync-skill.js",

20 "test": "vitest run",

21 "test:watch": "vitest",

22 "prepublishOnly": "npm run build && npm test"

23 },

24 "keywords": [

25 "todoist",

26 "cli",

27 "todo",

28 "tasks"

29 ],

30 "author": "Ernesto García <ernesto@ernesto.dev>",

31 "license": "MIT",

32 "repository": {

33 "type": "git",

34 "url": "git+https://github.com/Doist/todoist-cli.git"

35 },

36 "homepage": "https://github.com/Doist/todoist-cli#readme",

37 "bugs": {

scripts/check-skill-sync.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2

3/**

4 * Verifies that skills/todoist-cli/SKILL.md is in sync with the generated

5 * skill content from src/lib/skills/content.ts.

6 *

7 * Requires `npm run build` to have been run first.

8 */

9

10import { readFile } from 'node:fs/promises'

dist/lib/skills/create-installer.jsView file

Lines 79-119javascript

79 await removeEmptyDirs(dirname(filepath), 2);

80 }

81 return {

82 name: config.name,

83 description: config.description,

84 getInstallPath,

85 getLegacyInstallPath,

11

import { dirname, join } from 'node:path'

12import { fileURLToPath, pathToFileURL } from 'node:url'

13

14const root = join(dirname(fileURLToPath(import.meta.url)), '..')

15

16try {

17 const modulePath = pathToFileURL(join(root, 'dist/lib/skills/create-installer.js')).href

18 const { generateSkillFile } = await import(modulePath)

19 const expected = generateSkillFile()

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/check-skill-sync.jsView on unpkg · L17

20 const actual = await readFile(join(root, 'skills/todoist-cli/SKILL.md'), 'utf-8')

21

22 if (actual !== expected) {

23 console.error(

24 'ERROR: skills/todoist-cli/SKILL.md is out of sync with src/lib/skills/content.ts',

25 )

26 console.error('')

27 console.error('To fix, run:')

28 console.error(' npm run sync:skill')

29 process.exit(1)

30 }

31

32 console.log('skills/todoist-cli/SKILL.md is in sync with content.ts')

33} catch (err) {

34 if (err.code === 'ERR_MODULE_NOT_FOUND') {

35 console.error('ERROR: dist/ not found. Run `npm run build` first.')

36 } else {

37 console.error(err)

86 hasLegacyInstall,

87 generateContent() {

88 return generateSkillFile();

89 },

90 async isInstalled(local) {

91 try {

92 await access(getInstallPath(local));

93 return true;

94 }

95 catch {

96 return false;

97 }

98 },

99 async install(local, force) {

100 if (!local && config.dirName !== '.agents') {

101 const agentDir = join(homedir(), config.dirName);

102 try {

103 await access(agentDir);

104 }

105 catch {

106 throw new CliError('NOT_INSTALLED', `${config.name} does not appear to be installed (${agentDir} not found)`);

107 }

108 }

109 const filepath = getInstallPath(local);

110 const exists = await this.isInstalled(local);

111 if (exists && !force) {

112 throw new CliError('ALREADY_EXISTS', `Skill file already exists at ${filepath}. Use --force to overwrite.`);

113 }

114 await mkdir(dirname(filepath), { recursive: true });

115 await writeFile(filepath, this.generateContent(), 'utf-8');

116 await removeLegacyInstall(local);

117 },

118 async update(local) {

119 const filepath = getInstallPath(local);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/lib/skills/create-installer.jsView on unpkg · L99