registry / @doist/twist-cli / 3.0.10
@doist/twist-cli@3.0.10
TypeScript CLI for Twist
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe install hook only overwrites this package's own twist-cli skill files when they already exist in agent skill directories, which is first-party agent-extension setup rather than a new hijack. Scanner malware labels on dist/lib/input.js are a false match for spawning the user's editor, and remaining network and auth code is a normal Twist CLI.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
npm install of @doist/twist-cli, which runs the postinstall script.
Impact
Coding agents that already had the Twist CLI skill may load updated instructions after an unattended package install.
Mechanism
first-party agent skill auto-update on install
AI rationale
The install hook only overwrites this package's own twist-cli skill files when they already exist in agent skill directories, which is first-party agent-extension setup rather than a new hijack. Scanner malware labels on dist/lib/input.js are a false match for spawning the user's editor, and remaining network and auth code is a normal Twist CLI.
Evidence
package.jsonscripts/postinstall.jsdist/postinstall.jsdist/lib/skills/update-installed.jsdist/lib/skills/index.jsdist/lib/skills/create-installer.js~/.claude/skills/twist-cli/SKILL.md~/.codex/skills/twist-cli/SKILL.md~/.cursor/skills/twist-cli/SKILL.md~/.gemini/skills/twist-cli/SKILL.md~/.pi/skills/twist-cli/SKILL.md~/.agents/skills/twist-cli/SKILL.md
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- npm postinstall runs node scripts/postinstall.js, which loads dist/postinstall.js.
- postinstall calls updateAllInstalledSkills({ local: false }) and swallows errors.
- That updater overwrites SKILL.md for any already-installed Twist skill.
- Installers write into ~/.claude, ~/.codex, ~/.cursor, ~/.gemini, ~/.pi, and ~/.agents skill dirs.
- create-installer writes bundled twist-cli skill markdown into those agent paths.
Evidence against
- Updates run only when the twist-cli skill file already exists; missing skills are skipped.
- New skill drops require an explicit tw skill install command, not a blank install.
- Bundled skill text is Twist CLI usage docs, not a remote payload or secret harvester.
- dist/lib/input.js spawn is the user EDITOR for composing messages, not a malware loader.
- Network use is Twist API and GitHub logo URLs aligned with this CLI.
- No runtime self-dependency, obfuscation, or install-time credential theft.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVars
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/check-skill-sync.jsView file
Findings
1 Critical4 High5 Medium5 Low
CriticalAi Agent Control Hijackdist/lib/skills/create-installer.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedpackage.json
HighKnown Malware Source Similaritydist/lib/input.js
HighKnown Malware Source Fingerprint Signaturedist/lib/input.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirescripts/check-skill-sync.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to @doist/twist-cli@3.0.10.
See all versions of @doist/twist-cli for other recorded verdicts.
- Review the evidence and your use of @doist/twist-cli@3.0.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.