Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@doist/todoist-cli@5.4.5: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged as agent extension risk

Allowed by default with warning: install-time first-party agent extension setup was detected.

View on npm All versions Policy details

registry / @doist/todoist-cli / 5.4.5

@doist/todoist-cli@5.4.5

TypeScript CLI for Todoist

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installation automatically refreshes existing Todoist agent skills. This creates a guarded agent extension lifecycle risk; no confirmed malicious attack was established.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall when a current or legacy global Todoist skill already exists.

Impact

Existing agent instructions can change silently during package installation, within the Todoist skill scope.

Mechanism

Checks for an installed skill, overwrites its generated content, and removes legacy skill files.

AI rationale

Source confirms automatic, guarded updates to package-owned agent skills, which the review policy classifies as warning-only lifecycle risk. No concrete malicious chain was identified in the inspected behavior.

Evidence

package.jsonscripts/postinstall.jsdist/postinstall.jsdist/lib/skills/update-installed.jsdist/lib/skills/create-installer.jsdist/lib/skills/index.jsdist/lib/skills/content.js

Network endpoints1

api.todoist.com/api/v1/user

Decision evidence

public snapshot

Stop threats before they install.

Firewall

Threat feed
How it works
Policy

LPM

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json activates scripts/postinstall.js automatically after installation.
dist/postinstall.js silently invokes global skill updates.
Skill updates are gated on an existing current or legacy Todoist skill.
The installer overwrites generated skill content and removes the legacy installation.
Installer targets include Claude Code and Codex directories.
The generated skill is scoped to the todoist-cli skill name.

Evidence against

The existing-skill gate prevents automatic creation across previously unconfigured agents.
Authentication migration sends the legacy token to a fixed api.todoist.com endpoint; no unrelated credential recipient was identified.
The manifest contains no runtime self-dependency.

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 251 file(s), 779 KB of source, external domains: api.todoist.com, app.todoist.com, example.com, files.todoist.com, get.todoist.help, github.com, todoist.com, todoist.zendesk.com, www.todoist.com, www.w3.org

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/check-skill-sync.jsView file

17const modulePath = pathToFileURL(join(root, 'dist/lib/skills/create-installer.js')).href L18: const { generateSkillFile } = await import(modulePath) L19: const expected = generateSkillFile()

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/check-skill-sync.jsView on unpkg · L17

dist/lib/skills/create-installer.jsView file

99async install(local, force) { L100: if (!local && config.dirName !== '.agents') { L101: const agentDir = join(homedir(), config.dirName); ... L113: } L114: await mkdir(dirname(filepath), { recursive: true }); L115: await writeFile(filepath, this.generateContent(), 'utf-8'); ... L119: const filepath = getInstallPath(local); L120: await mkdir(dirname(filepath), { recursive: true }); L121: await writeFile(filepath, this.generateContent(), 'utf-8');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/lib/skills/create-installer.jsView on unpkg · L99

Findings

1 Critical1 High5 Medium5 Low

CriticalAi Agent Control Hijackdist/lib/skills/create-installer.js

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/check-skill-sync.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @doist/todoist-cli@5.4.5.

See version security history for other recorded verdicts.

Review the evidence and your use of @doist/todoist-cli@5.4.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-02 11:56:37.559Z (UTC).

94%Suspicious

AI assessment confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskMedium

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

AuthorErnesto García

Maintainersricardoist, henningmu, jvalente +9

Version5.4.5

Latest on npm5.4.9

PublishedOct 2, 2026

LicenseMIT

Dependencies12

Integrityverified

Package size382 KB

Files999

Keywordstodoistclitodotasks

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/index.jstypes → ./dist/index.d.tsbin → td

Runtimenpm >=11node >=24

Artifact1.71 MB · 999 files2 signature(s) · provenance

Install lifecyclepostinstallprepublishOnly

Behavioral surface

CryptoDynamicRequireEnvironmentVarsFilesystemNetworkHighEntropyStringsUrlStringsManifest: clean

LPM.dev Registry

© 2026 LPM

Source & flagged code

4 flagged

package.jsonView file

Lines 1-37json

1{

2 "name": "@doist/todoist-cli",

3 "version": "5.4.5",

4 "description": "TypeScript CLI for Todoist",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "td": "dist/index.js"

9 },

10 "scripts": {

11 "build": "tsc -p tsconfig.build.json",

12 "dev": "tsc -p tsconfig.build.json --watch",

13 "start": "node dist/index.js",

14 "type-check": "tsc --noEmit",

15 "check": "oxlint src && oxfmt --check",

16 "fix": "oxlint src --fix && oxfmt",

17 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "check:skill-sync": "node scripts/check-skill-sync.js",

19 "sync:skill": "npm run build && node scripts/sync-skill.js",

20 "test": "vitest run",

21 "test:watch": "vitest",

22 "prepublishOnly": "npm run build && npm test"

23 },

24 "keywords": [

25 "todoist",

26 "cli",

27 "todo",

28 "tasks"

29 ],

30 "author": "Ernesto García <ernesto@ernesto.dev>",

31 "license": "MIT",

32 "repository": {

33 "type": "git",

34 "url": "git+https://github.com/Doist/todoist-cli.git"

35 },

36 "homepage": "https://github.com/Doist/todoist-cli#readme",

37 "bugs": {

scripts/check-skill-sync.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2

3/**

4 * Verifies that skills/todoist-cli/SKILL.md is in sync with the generated

5 * skill content from src/lib/skills/content.ts.

6 *

7 * Requires `npm run build` to have been run first.

8 */

9

10import { readFile } from 'node:fs/promises'

dist/lib/skills/create-installer.jsView file

Lines 79-119javascript

79 await removeEmptyDirs(dirname(filepath), 2);

80 }

81 return {

82 name: config.name,

83 description: config.description,

84 getInstallPath,

85 getLegacyInstallPath,

11

import { dirname, join } from 'node:path'

12import { fileURLToPath, pathToFileURL } from 'node:url'

13

14const root = join(dirname(fileURLToPath(import.meta.url)), '..')

15

16try {

17 const modulePath = pathToFileURL(join(root, 'dist/lib/skills/create-installer.js')).href

18 const { generateSkillFile } = await import(modulePath)

19 const expected = generateSkillFile()

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/check-skill-sync.jsView on unpkg · L17

20 const actual = await readFile(join(root, 'skills/todoist-cli/SKILL.md'), 'utf-8')

21

22 if (actual !== expected) {

23 console.error(

24 'ERROR: skills/todoist-cli/SKILL.md is out of sync with src/lib/skills/content.ts',

25 )

26 console.error('')

27 console.error('To fix, run:')

28 console.error(' npm run sync:skill')

29 process.exit(1)

30 }

31

32 console.log('skills/todoist-cli/SKILL.md is in sync with content.ts')

33} catch (err) {

34 if (err.code === 'ERR_MODULE_NOT_FOUND') {

35 console.error('ERROR: dist/ not found. Run `npm run build` first.')

36 } else {

37 console.error(err)

86 hasLegacyInstall,

87 generateContent() {

88 return generateSkillFile();

89 },

90 async isInstalled(local) {

91 try {

92 await access(getInstallPath(local));

93 return true;

94 }

95 catch {

96 return false;

97 }

98 },

99 async install(local, force) {

100 if (!local && config.dirName !== '.agents') {

101 const agentDir = join(homedir(), config.dirName);

102 try {

103 await access(agentDir);

104 }

105 catch {

106 throw new CliError('NOT_INSTALLED', `${config.name} does not appear to be installed (${agentDir} not found)`);

107 }

108 }

109 const filepath = getInstallPath(local);

110 const exists = await this.isInstalled(local);

111 if (exists && !force) {

112 throw new CliError('ALREADY_EXISTS', `Skill file already exists at ${filepath}. Use --force to overwrite.`);

113 }

114 await mkdir(dirname(filepath), { recursive: true });

115 await writeFile(filepath, this.generateContent(), 'utf-8');

116 await removeLegacyInstall(local);

117 },

118 async update(local) {

119 const filepath = getInstallPath(local);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/lib/skills/create-installer.jsView on unpkg · L99