Loading npm security reports…

@todoforai/cli@0.1.55: Suspicious npm security report (Warn) | LPM Firewall

registry / @todoforai/cli / 0.1.55

@todoforai/cli@0.1.55

CLI for [TODOforAI](https://todofor.ai) — create, watch, and inspect AI-powered todos.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

No install-time or covert attack was identified. The package is a user-invoked CLI for the TODOforAI service, and the remote bridge installer runs only as part of that command when the companion binary is missing.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A user runs the published CLI for a watch-capable todo command without --no-bridge.

Impact

Network use and a local companion install stay tied to the product the user launched. No unconsented credential export, agent-config hijack, or lifecycle payload was found.

Mechanism

The process authenticates to the configured TODOforAI API and, if todoforai-bridge is absent, runs the documented vendor installer and starts that local bridge.

AI rationale

There is no npm install lifecycle hook, self-install chain, or hidden exfiltration. Remote shell install of the companion bridge is gated by an explicit CLI run, logged, and pointed at the vendor host.

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean, but the final policy action is warn. This report does not record a matching static-policy override reason.

Evidence for AI clean decision

package.json publishes a Node CLI with bin entries only. scripts are build, prepublishOnly, start, and dev, with no preinstall, install, or postinstall hook.

Source & flagged code

11 flagged · loading source

dist/todoforai-cli.jsView file

45187// src/ensure-bridge.ts L45188: import { spawn, spawnSync } from "child_process"; L45189: import fs2 from "fs"; ... L45191: import os2 from "os"; L45192: var INSTALLER_URL = "https://todofor.ai/bridge"; L45193: var INSTALL_PREFIX = process.env.TODOFORAI_PREFIX || path2.join(os2.homedir(), ".todoforai", "bin"); L45194: var INSTALL_TIMEOUT_MS = 90000;

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/todoforai-cli.jsView on unpkg · L45187

309if (lineHash.hasOwnProperty ? lineHash.hasOwnProperty(line) : lineHash[line] !== undefined) { L310: chars += String.fromCharCode(lineHash[line]); L311: } else { ... L1919: } L1920: exec(s) { L1921: this.matcherRe.lastIndex = this.lastIndex; ... L2089: props: ["language", "code", "autodetect"], L2090: data: function() { L2091: return { ... L2287: deprecated("10.7.0", `Please use highlight(code, options) instead. L2288: https://github.com/highlightjs/highlight.js/issues/2277`); L2289: languageName = codeOrlanguageName;

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/todoforai-cli.jsView on unpkg · L309

309if (lineHash.hasOwnProperty ? lineHash.hasOwnProperty(line) : lineHash[line] !== undefined) { L310: chars += String.fromCharCode(lineHash[line]); L311: } else { ... L1919: } L1920: exec(s) { L1921: this.matcherRe.lastIndex = this.lastIndex; ... L2089: props: ["language", "code", "autodetect"], L2090: data: function() { L2091: return { ... L2287: deprecated("10.7.0", `Please use highlight(code, options) instead. L2288: https://github.com/highlightjs/highlight.js/issues/2277`); L2289: languageName = codeOrlanguageName;

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/todoforai-cli.jsView on unpkg · L309

309if (lineHash.hasOwnProperty ? lineHash.hasOwnProperty(line) : lineHash[line] !== undefined) { L310: chars += String.fromCharCode(lineHash[line]); L311: } else { ... L1919: } L1920: exec(s) { L1921: this.matcherRe.lastIndex = this.lastIndex; ... L2089: props: ["language", "code", "autodetect"], L2090: data: function() { L2091: return { ... L2287: deprecated("10.7.0", `Please use highlight(code, options) instead. L2288: https://github.com/highlightjs/highlight.js/issues/2277`); L2289: languageName = codeOrlanguageName;

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/todoforai-cli.jsView on unpkg · L309

1919} L1920: exec(s) { L1921: this.matcherRe.lastIndex = this.lastIndex;

High

Child Process

Package source references child process execution.

dist/todoforai-cli.jsView on unpkg · L1919

45176if (!content) { L45177: process.stderr.write(`Error: Empty input L45178: `); ... L45187: // src/ensure-bridge.ts L45188: import { spawn, spawnSync } from "child_process"; L45189: import fs2 from "fs"; ... L45191: import os2 from "os"; L45192: var INSTALLER_URL = "https://todofor.ai/bridge"; L45193: var INSTALL_PREFIX = process.env.TODOFORAI_PREFIX || path2.join(os2.homedir(), ".todoforai", "bin");

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/todoforai-cli.jsView on unpkg · L45176

309if (lineHash.hasOwnProperty ? lineHash.hasOwnProperty(line) : lineHash[line] !== undefined) { L310: chars += String.fromCharCode(lineHash[line]); L311: } else { ... L1919: } L1920: exec(s) { L1921: this.matcherRe.lastIndex = this.lastIndex; ... L2089: props: ["language", "code", "autodetect"], L2090: data: function() { L2091: return { ... L2287: deprecated("10.7.0", `Please use highlight(code, options) instead. L2288: https://github.com/highlightjs/highlight.js/issues/2277`); L2289: languageName = codeOrlanguageName;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/todoforai-cli.jsView on unpkg · L309

26587keyword: "and case default else elsif false if in import enherits node or true undef unless main settings $string ", L26588: literal: "alias audit before loglevel noop require subscribe tag " + "owner ensure group mode name|0 changes context force incl lens load_path onlyif provider returns root show_dif... L26589: built_in: "architecture augeasversion blockdevices boardmanufacturer boardproductname boardserialnumber cfkey dhcp_servers " + "domain ec2_ ec2_userdata facterversion filesystems l... ... L42712: try { L42713: cache = JSON.parse(fs.readFileSync(cacheFile, "utf8")); L42714: } catch {} ... L45187: // src/ensure-bridge.ts L45188: import { spawn, spawnSync } from "child_process"; L45189: import fs2 from "fs";

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/todoforai-cli.jsView on unpkg · L26587

•matchType = normalized_sha256 matchedPackage = @todoforai/cli@0.1.50 matchedPath = dist/todoforai-cli.js matchedIdentity = npm:QHRvZG9mb3JhaS9jbGk:0.1.50 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/todoforai-cli.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 795061d6fefb86fb signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @todoforai/cli@0.1.50 matchedPath = dist/todoforai-cli.js matchedIdentity = npm:QHRvZG9mb3JhaS9jbGk:0.1.50 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/todoforai-cli.jsView on unpkg

bin/todoforai-cli.jsView file

9const dist = fileURLToPath(new URL("../dist/todoforai-cli.js", import.meta.url)); L10: await import(existsSync(src) && typeof Bun !== "undefined" ? src : dist);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/todoforai-cli.jsView on unpkg · L9

Source & flagged code

11 flagged

dist/todoforai-cli.jsView file

45187// src/ensure-bridge.ts L45188: import { spawn, spawnSync } from "child_process"; L45189: import fs2 from "fs"; ... L45191: import os2 from "os"; L45192: var INSTALLER_URL = "https://todofor.ai/bridge"; L45193: var INSTALL_PREFIX = process.env.TODOFORAI_PREFIX || path2.join(os2.homedir(), ".todoforai", "bin"); L45194: var INSTALL_TIMEOUT_MS = 90000;

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/todoforai-cli.jsView on unpkg · L45187

309if (lineHash.hasOwnProperty ? lineHash.hasOwnProperty(line) : lineHash[line] !== undefined) { L310: chars += String.fromCharCode(lineHash[line]); L311: } else { ... L1919: } L1920: exec(s) { L1921: this.matcherRe.lastIndex = this.lastIndex; ... L2089: props: ["language", "code", "autodetect"], L2090: data: function() { L2091: return { ... L2287: deprecated("10.7.0", `Please use highlight(code, options) instead. L2288: https://github.com/highlightjs/highlight.js/issues/2277`); L2289: languageName = codeOrlanguageName;

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/todoforai-cli.jsView on unpkg · L309

309if (lineHash.hasOwnProperty ? lineHash.hasOwnProperty(line) : lineHash[line] !== undefined) { L310: chars += String.fromCharCode(lineHash[line]); L311: } else { ... L1919: } L1920: exec(s) { L1921: this.matcherRe.lastIndex = this.lastIndex; ... L2089: props: ["language", "code", "autodetect"], L2090: data: function() { L2091: return { ... L2287: deprecated("10.7.0", `Please use highlight(code, options) instead. L2288: https://github.com/highlightjs/highlight.js/issues/2277`); L2289: languageName = codeOrlanguageName;

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/todoforai-cli.jsView on unpkg · L309

309if (lineHash.hasOwnProperty ? lineHash.hasOwnProperty(line) : lineHash[line] !== undefined) { L310: chars += String.fromCharCode(lineHash[line]); L311: } else { ... L1919: } L1920: exec(s) { L1921: this.matcherRe.lastIndex = this.lastIndex; ... L2089: props: ["language", "code", "autodetect"], L2090: data: function() { L2091: return { ... L2287: deprecated("10.7.0", `Please use highlight(code, options) instead. L2288: https://github.com/highlightjs/highlight.js/issues/2277`); L2289: languageName = codeOrlanguageName;

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/todoforai-cli.jsView on unpkg · L309

1919} L1920: exec(s) { L1921: this.matcherRe.lastIndex = this.lastIndex;

High

Child Process

Package source references child process execution.

dist/todoforai-cli.jsView on unpkg · L1919

45176if (!content) { L45177: process.stderr.write(`Error: Empty input L45178: `); ... L45187: // src/ensure-bridge.ts L45188: import { spawn, spawnSync } from "child_process"; L45189: import fs2 from "fs"; ... L45191: import os2 from "os"; L45192: var INSTALLER_URL = "https://todofor.ai/bridge"; L45193: var INSTALL_PREFIX = process.env.TODOFORAI_PREFIX || path2.join(os2.homedir(), ".todoforai", "bin");

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/todoforai-cli.jsView on unpkg · L45176

309if (lineHash.hasOwnProperty ? lineHash.hasOwnProperty(line) : lineHash[line] !== undefined) { L310: chars += String.fromCharCode(lineHash[line]); L311: } else { ... L1919: } L1920: exec(s) { L1921: this.matcherRe.lastIndex = this.lastIndex; ... L2089: props: ["language", "code", "autodetect"], L2090: data: function() { L2091: return { ... L2287: deprecated("10.7.0", `Please use highlight(code, options) instead. L2288: https://github.com/highlightjs/highlight.js/issues/2277`); L2289: languageName = codeOrlanguageName;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/todoforai-cli.jsView on unpkg · L309

26587keyword: "and case default else elsif false if in import enherits node or true undef unless main settings $string ", L26588: literal: "alias audit before loglevel noop require subscribe tag " + "owner ensure group mode name|0 changes context force incl lens load_path onlyif provider returns root show_dif... L26589: built_in: "architecture augeasversion blockdevices boardmanufacturer boardproductname boardserialnumber cfkey dhcp_servers " + "domain ec2_ ec2_userdata facterversion filesystems l... ... L42712: try { L42713: cache = JSON.parse(fs.readFileSync(cacheFile, "utf8")); L42714: } catch {} ... L45187: // src/ensure-bridge.ts L45188: import { spawn, spawnSync } from "child_process"; L45189: import fs2 from "fs";

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/todoforai-cli.jsView on unpkg · L26587

•matchType = normalized_sha256 matchedPackage = @todoforai/cli@0.1.50 matchedPath = dist/todoforai-cli.js matchedIdentity = npm:QHRvZG9mb3JhaS9jbGk:0.1.50 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/todoforai-cli.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 795061d6fefb86fb signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @todoforai/cli@0.1.50 matchedPath = dist/todoforai-cli.js matchedIdentity = npm:QHRvZG9mb3JhaS9jbGk:0.1.50 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/todoforai-cli.jsView on unpkg

bin/todoforai-cli.jsView file

Lines 1-11javascript

1#!/usr/bin/env node

2// Dev (linked repo) under bun: run src directly so there is no stale-build step.

3// Node (and the published package, which ships only dist/) runs the bundle;

4// the @shared/* file: deps are bundled in.

5import { existsSync } from "node:fs";

6import { fileURLToPath } from "node:url";

7

8