registry / @doist/twist-cli / 2.45.8

@doist/twist-cli@2.45.8

TypeScript CLI for Twist

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 120 file(s), 392 KB of source, external domains: api.twist.com, github.com, raw.githubusercontent.com, twist.com, www.w3.org

Source & flagged code

3 flagged

package.jsonView file

Lines 1-37json

2 "name": "@doist/twist-cli",

3 "version": "2.45.8",

4 "description": "TypeScript CLI for Twist",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "tw": "dist/index.js"

9 },

10 "scripts": {

11 "build": "tsc -p tsconfig.build.json && chmod +x dist/index.js",

12 "dev": "tsc -p tsconfig.build.json --watch",

13 "start": "node dist/index.js",

14 "type-check": "tsc --noEmit",

15 "lint": "oxlint . --fix && oxfmt",

16 "lint:check": "oxlint . && oxfmt --check",

17 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "check:skill-sync": "node scripts/check-skill-sync.js",

19 "sync:skill": "npm run build && node scripts/sync-skill.js",

20 "test": "vitest run",

21 "test:watch": "vitest",

22 "prepublishOnly": "npm run build && npm test"

23 },

24 "keywords": [

25 "twist",

26 "cli",

27 "messaging",

28 "doist"

29 ],

30 "author": "Ernesto García <ernesto@ernesto.dev>",

31 "license": "MIT",

32 "engines": {

33 "node": "^20.19.0 || >=22.12.0"

34 },

35 "repository": {

36 "type": "git",

37 "url": "https://github.com/Doist/twist-cli.git"

scripts/check-skill-sync.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

3/**

4 * Verifies that skills/twist-cli/SKILL.md is in sync with the generated

5 * skill content from src/lib/skills/content.ts.

6 *

7 * Requires `npm run build` to have been run first.

8 */

10import { readFile } from 'node:fs/promises'

Source & flagged code

3 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code