Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@doist/todoist-cli@5.4.4: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged as agent extension risk

Allowed by default with warning: install-time first-party agent extension setup was detected.

View on npm All versions Policy details

registry / @doist/todoist-cli / 5.4.4

@doist/todoist-cli@5.4.4

TypeScript CLI for Todoist

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installation automatically replaces existing Todoist CLI agent skills. This is a guarded extension lifecycle risk; no confirmed malicious attack was established.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation when a current or legacy Todoist CLI skill already exists.

Impact

Existing agent instructions can change automatically during package installation without a separate skill-update command.

Mechanism

The postinstall entrypoint checks installed skills, writes bundled generated content, and removes legacy skill files.

AI rationale

Source confirms automatic updates to existing package-owned agent skills, which warrants a guarded lifecycle warning under the supplied policy. Existing-installation gates and the fixed Todoist authentication destination do not support the scanner's malicious classification.

Evidence

package.jsonscripts/postinstall.jsdist/postinstall.jsdist/lib/skills/update-installed.jsdist/lib/skills/create-installer.jsdist/lib/skills/index.jsSKILL.md

Network endpoints1

api.todoist.com/api/v1/user

Decision evidence

Stop threats before they install.

Firewall

Threat feed
How it works
Policy

LPM

public snapshot

AI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json automatically runs scripts/postinstall.js during installation.
dist/postinstall.js automatically updates globally installed skills.
dist/lib/skills/update-installed.js gates updates on an existing current or legacy skill installation.
dist/lib/skills/create-installer.js overwrites generated skill content and removes the legacy installation.
Skill writes are confined to the package's skill file beneath each configured agent directory.
Legacy authentication migration sends the token to the fixed Todoist user endpoint.

Evidence against

Existing-installation checks prevent automatic creation of skills for previously unconfigured agents.
The inspected lifecycle behavior does not establish credential theft, remote payload execution, or broad agent configuration mutation.

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 251 file(s), 779 KB of source, external domains: api.todoist.com, app.todoist.com, example.com, files.todoist.com, get.todoist.help, github.com, todoist.com, todoist.zendesk.com, www.todoist.com, www.w3.org

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/check-skill-sync.jsView file

17const modulePath = pathToFileURL(join(root, 'dist/lib/skills/create-installer.js')).href L18: const { generateSkillFile } = await import(modulePath) L19: const expected = generateSkillFile()

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/check-skill-sync.jsView on unpkg · L17

dist/lib/skills/create-installer.jsView file

99async install(local, force) { L100: if (!local && config.dirName !== '.agents') { L101: const agentDir = join(homedir(), config.dirName); ... L113: } L114: await mkdir(dirname(filepath), { recursive: true }); L115: await writeFile(filepath, this.generateContent(), 'utf-8'); ... L119: const filepath = getInstallPath(local); L120: await mkdir(dirname(filepath), { recursive: true }); L121: await writeFile(filepath, this.generateContent(), 'utf-8');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/lib/skills/create-installer.jsView on unpkg · L99

Findings

1 Critical1 High5 Medium5 Low

CriticalAi Agent Control Hijackdist/lib/skills/create-installer.js

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/check-skill-sync.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @doist/todoist-cli@5.4.4.

See version security history for other recorded verdicts.

Review the evidence and your use of @doist/todoist-cli@5.4.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-02 00:04:00.294Z (UTC).

96%Suspicious

AI assessment confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

AuthorErnesto García

Maintainersricardoist, henningmu, jvalente +9

Version5.4.4

Latest on npm5.4.9

PublishedOct 1, 2026

LicenseMIT

Dependencies12

Integrityverified

Package size382 KB

Files999

Keywordstodoistclitodotasks

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/index.jstypes → ./dist/index.d.tsbin → td

Runtimenpm >=11node >=24

Artifact1.71 MB · 999 files2 signature(s) · provenance

Install lifecyclepostinstallprepublishOnly

Behavioral surface

CryptoDynamicRequireEnvironmentVarsFilesystemNetworkHighEntropyStringsUrlStringsManifest: clean

LPM.dev Registry

© 2026 LPM

Source & flagged code

4 flagged

package.jsonView file

Lines 1-37json

1{

2 "name": "@doist/todoist-cli",

3 "version": "5.4.4",

4 "description": "TypeScript CLI for Todoist",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "td": "dist/index.js"

9 },

10 "scripts": {

11 "build": "tsc -p tsconfig.build.json",

12 "dev": "tsc -p tsconfig.build.json --watch",

13 "start": "node dist/index.js",

14 "type-check": "tsc --noEmit",

15 "check": "oxlint src && oxfmt --check",

16 "fix": "oxlint src --fix && oxfmt",

17 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "check:skill-sync": "node scripts/check-skill-sync.js",

19 "sync:skill": "npm run build && node scripts/sync-skill.js",

20 "test": "vitest run",

21 "test:watch": "vitest",

22 "prepublishOnly": "npm run build && npm test"

23 },

24 "keywords": [

25 "todoist",

26 "cli",

27 "todo",

28 "tasks"

29 ],

30 "author": "Ernesto García <ernesto@ernesto.dev>",

31 "license": "MIT",

32 "repository": {

33 "type": "git",

34 "url": "git+https://github.com/Doist/todoist-cli.git"

35 },

36 "homepage": "https://github.com/Doist/todoist-cli#readme",

37 "bugs": {

scripts/check-skill-sync.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2

3/**

4 * Verifies that skills/todoist-cli/SKILL.md is in sync with the generated

5 * skill content from src/lib/skills/content.ts.

6 *

7 * Requires `npm run build` to have been run first.

8 */

9

10import { readFile } from 'node:fs/promises'

dist/lib/skills/create-installer.jsView file

Lines 79-119javascript

79 await removeEmptyDirs(dirname(filepath), 2);

80 }

81 return {

82 name: config.name,

83 description: config.description,

84 getInstallPath,

85 getLegacyInstallPath,

11

import { dirname, join } from 'node:path'

12import { fileURLToPath, pathToFileURL } from 'node:url'

13

14const root = join(dirname(fileURLToPath(import.meta.url)), '..')

15

16try {

17 const modulePath = pathToFileURL(join(root, 'dist/lib/skills/create-installer.js')).href

18 const { generateSkillFile } = await import(modulePath)

19 const expected = generateSkillFile()

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/check-skill-sync.jsView on unpkg · L17

20 const actual = await readFile(join(root, 'skills/todoist-cli/SKILL.md'), 'utf-8')

21

22 if (actual !== expected) {

23 console.error(

24 'ERROR: skills/todoist-cli/SKILL.md is out of sync with src/lib/skills/content.ts',

25 )

26 console.error('')

27 console.error('To fix, run:')

28 console.error(' npm run sync:skill')

29 process.exit(1)

30 }

31

32 console.log('skills/todoist-cli/SKILL.md is in sync with content.ts')

33} catch (err) {

34 if (err.code === 'ERR_MODULE_NOT_FOUND') {

35 console.error('ERROR: dist/ not found. Run `npm run build` first.')

36 } else {

37 console.error(err)

86 hasLegacyInstall,

87 generateContent() {

88 return generateSkillFile();

89 },

90 async isInstalled(local) {

91 try {

92 await access(getInstallPath(local));

93 return true;

94 }

95 catch {

96 return false;

97 }

98 },

99 async install(local, force) {

100 if (!local && config.dirName !== '.agents') {

101 const agentDir = join(homedir(), config.dirName);

102 try {

103 await access(agentDir);

104 }

105 catch {

106 throw new CliError('NOT_INSTALLED', `${config.name} does not appear to be installed (${agentDir} not found)`);

107 }

108 }

109 const filepath = getInstallPath(local);

110 const exists = await this.isInstalled(local);

111 if (exists && !force) {

112 throw new CliError('ALREADY_EXISTS', `Skill file already exists at ${filepath}. Use --force to overwrite.`);

113 }

114 await mkdir(dirname(filepath), { recursive: true });

115 await writeFile(filepath, this.generateContent(), 'utf-8');

116 await removeLegacyInstall(local);

117 },

118 async update(local) {

119 const filepath = getInstallPath(local);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/lib/skills/create-installer.jsView on unpkg · L99