@togglhq/cli@1.13.117
Toggl CLI for Toggl 2.0 API operations.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package is not clearly malicious: the reviewed analytics payload excludes command arguments and results and has an opt-out. However, runtime analytics is enabled by default and associates command activity with a stable account identifier without disclosure found in the package README, so this warrants a warning.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the toggl CLI; telemetry initialization happens before command parsing.
Impact
Toggl’s analytics service receives command usage and an account-linked identifier without a disclosure found in the package README; the reviewed event payload excludes arguments and results.
Mechanism
The CLI sends allowlisted tool invocation events to PostHog and derives the signed-in distinct ID from the saved Toggl access token’s subject. Analytics can be disabled through an environment variable.
AI rationale
The package is not clearly malicious: the reviewed analytics payload excludes command arguments and results and has an opt-out. However, runtime analytics is enabled by default and associates command activity with a stable account identifier without disclosure found in the package README, so this warrants a warning.
Evidence
build/cli.jsbuild/program-D7hdqg8n.js
Network endpoints2
eu.i.posthog.como43910.ingest.us.sentry.io
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The CLI bin calls initCliTelemetry on startup before parsing commands.
- Product analytics is enabled by default; TOGGL_PRODUCT_ANALYTICS can disable it.
- Analytics events contain tool/action/outcome and session/version fields; the source says arguments and results are excluded.
- For signed-in profiles, the analytics distinct ID is derived from the Toggl access token’s account subject.
- Events are sent to the default PostHog host, eu.i.posthog.com.
Evidence against
- The event payload uses an allowlist and does not include command arguments or results.
- An environment variable provides an opt-out for product analytics.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggedbuild/program-D7hdqg8n.jsView file
6import { fileURLToPath } from "node:url";
L7: import { exec, spawn } from "node:child_process";
L8: import process$1 from "node:process";
High
Child Process
Package source references child process execution.
build/program-D7hdqg8n.jsView on unpkg · L61830if (process$3.versions?.electron) parseOptions.from = "electron";
L1831: const execArgv = process$3.execArgv ?? [];
L1832: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) parseOptions.from = "eval";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
build/program-D7hdqg8n.js:
import * as readline from "node:readline";
import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
import { createInterface } from "node:readline/promises";
function readline$1() {
const cleanFn = cb(readline$1());
* Returns the width of the active readline, or 80 as default value.
function readlineWidth() {
output: readline$1().output
Findings
5 High2 Medium5 Low
HighChild Processbuild/program-D7hdqg8n.js
HighShellbuild/program-D7hdqg8n.js
HighCredential Redirect Persistencebuild/program-D7hdqg8n.js
HighCommand Output Exfiltrationbuild/program-D7hdqg8n.js
HighTrigger Reachable Command Output Exfiltrationbuild/program-D7hdqg8n.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @togglhq/cli@1.13.117.
See all versions of @togglhq/cli for other recorded verdicts.
- Review the evidence and your use of @togglhq/cli@1.13.117 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.