registry / @doist/twist-cli / 3.0.11

@doist/twist-cli@3.0.11

TypeScript CLI for Twist

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a Twist CLI that, on postinstall, only overwrites its own already-installed agent skill file in well-known agent skill folders. That is first-party agent-extension setup with a lifecycle hook, not unconsented hijack of foreign agent configs or other malware behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install of @doist/twist-cli, which runs the postinstall script

Impact

Agents that already have the Twist CLI skill may load an updated SKILL.md without a new user command

Mechanism

guarded first-party agent skill refresh on install

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/postinstall.jsdist/lib/skills/index.jsdist/lib/skills/create-installer.jsdist/lib/skills/update-installed.js~/.claude/skills/twist-cli/SKILL.md~/.codex/skills/twist-cli/SKILL.md~/.cursor/skills/twist-cli/SKILL.md~/.gemini/skills/twist-cli/SKILL.md~/.pi/skills/twist-cli/SKILL.md~/.agents/skills/twist-cli/SKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

npm postinstall runs scripts/postinstall.js, which loads dist/postinstall.js.
After install, the package silently refreshes already-installed Twist skills under the user home directory and migrates local Twist auth.
Skill installers write into foreign agent skill folders under .claude, .codex, .cursor, .gemini, .pi, and .agents.
The installer only writes this package's skills/twist-cli/SKILL.md file, and postinstall skips agents where that file is not already present.
New skill drops still require an explicit tw skill install command rather than the lifecycle hook.

Evidence against

Scanner malware fingerprints on dist/lib/input.js are ordinary $EDITOR spawning for composing a message.
Network use is the Twist API at api.twist.com with the user's Twist token through the official SDK.
There is no eval, no runtime self-dependency, and no writes to unrelated agent config files such as CLAUDE.md or MCP settings.
The skill body is Twist CLI usage text for agents, not a hidden payload.

Behavioral surface

Source

ChildProcess

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/check-skill-sync.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

3/**

4 * Verifies that skills/twist-cli/SKILL.md is in sync with the generated

5 * skill content from src/lib/skills/content.ts.

6 *

7 * Requires `npm run build` to have been run first.

8 */

10import { readFile } from 'node:fs/promises'

11import { dirname, join } from 'node:path'

12import { fileURLToPath, pathToFileURL } from 'node:url'

14const root = join(dirname(fileURLToPath(import.meta.url)), '..')

16try {

17 const modulePath = pathToFileURL(join(root, 'dist/lib/skills/content.js')).href

18 const { SKILL_FILE_CONTENT } = await import(modulePath)

19 const expected = SKILL_FILE_CONTENT

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/check-skill-sync.jsView on unpkg · L17

20 const actual = await readFile(join(root, 'skills/twist-cli/SKILL.md'), 'utf-8')

22 if (actual !== expected) {

23 console.error(

24 'ERROR: skills/twist-cli/SKILL.md is out of sync with src/lib/skills/content.ts',

25 )

26 console.error('')

27 console.error('To fix, run:')

28 console.error(' npm run build && npm run sync:skill')

29 process.exit(1)

30 }

32 console.log('skills/twist-cli/SKILL.md is in sync with content.ts')

33} catch (err) {

34 if (err.code === 'ERR_MODULE_NOT_FOUND') {

35 console.error('ERROR: dist/ not found. Run `npm run build` first.')

36 } else {

37 console.error(err)

dist/lib/skills/create-installer.jsView file

Lines 4-44javascript

4import { CliError } from '../errors.js';

5import { SKILL_FILE_CONTENT, SKILL_NAME } from './content.js';

6export function createInstaller(config) {

7 function getInstallPath

dist/lib/input.jsView file

•matchType = normalized_sha256 matchedPackage = @doist/twist-cli@3.0.8 matchedPath = dist/lib/input.js matchedIdentity = npm:QGRvaXN0L3R3aXN0LWNsaQ:3.0.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/input.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = acd00388ab62c770 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @doist/twist-cli@3.0.8 matchedPath = dist/lib/input.js matchedIdentity = npm:QGRvaXN0L3R3aXN0LWNsaQ:3.0.8 similarity = 1.000 shingleOverlap = 22 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/lib/input.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/check-skill-sync.jsView file

17const modulePath = pathToFileURL(join(root, 'dist/lib/skills/content.js')).href L18: const { SKILL_FILE_CONTENT } = await import(modulePath) L19: const expected = SKILL_FILE_CONTENT

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/check-skill-sync.jsView on unpkg · L17

Findings

1 Critical3 High5 Medium5 Low

CriticalAi Agent Control Hijackdist/lib/skills/create-installer.js

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritydist/lib/input.js

HighKnown Malware Source Fingerprint Signaturedist/lib/input.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/check-skill-sync.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @doist/twist-cli@3.0.11.

See all versions of @doist/twist-cli for other recorded verdicts.

Review the evidence and your use of @doist/twist-cli@3.0.11 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 00:49:00.007Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @doist

Runtime surface

Behavioral surface

Related packages

More from @doist

Source & flagged code