@togglhq/cli@1.13.160
Toggl CLI for Toggl 2.0 API operations.
AI Security Review
scanned 4h ago · by lpm-firewall-aiThe CLI sends runtime analytics by default and provides an environment-variable opt-out, but the README does not disclose the collection. The observed payload is limited to command metadata and a session identifier, so this is suspicious telemetry rather than malicious data theft.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the CLI binary; initialization happens before command parsing.
Impact
Toggl can associate CLI command and outcome events with an anonymous session. No credential or command-output exfiltration was identified.
Mechanism
The CLI uses a built-in PostHog key unless analytics are disabled through an environment variable, then posts allowlisted command metadata and a session identifier.
AI rationale
The CLI sends runtime analytics by default and provides an environment-variable opt-out, but the README does not disclose the collection. The observed payload is limited to command metadata and a session identifier, so this is suspicious telemetry rather than malicious data theft.
Evidence
build/cli.jsbuild/program-Bq2_rov1.js
Network endpoints1
eu.i.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI binary initializes telemetry before parsing any command.
- Product analytics uses a built-in Toggl PostHog key by default; an environment flag can disable it.
- Events contain command name, action, outcome, client, session ID, package version and error category; the code excludes command arguments and results.
- Analytics events are sent to eu.i.posthog.com.
Evidence against
- The analytics payload is limited to command metadata and a session identifier, not credentials or command output.
- The skills dependency reads GitHub tokens for repository-tree requests to api.github.com, consistent with fetching private skill repositories.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggedbuild/program-Bq2_rov1.jsView file
6import { fileURLToPath } from "node:url";
L7: import { exec, spawn } from "node:child_process";
L8: import process$1 from "node:process";
High
Child Process
Package source references child process execution.
build/program-Bq2_rov1.jsView on unpkg · L61830if (process$3.versions?.electron) parseOptions.from = "electron";
L1831: const execArgv = process$3.execArgv ?? [];
L1832: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) parseOptions.from = "eval";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
build/program-Bq2_rov1.js:
import * as readline from "node:readline";
import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
import { createInterface } from "node:readline/promises";
function readline$1() {
const cleanFn = cb(readline$1());
* Returns the width of the active readline, or 80 as default value.
function readlineWidth() {
output: readline$1().output
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
build/program-Bq2_rov1.jsView on unpkg12416const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start \"\"" : "xdg-open";
L12417: exec(`${cmd} "${url}"`, (err) => {
L12418: if (err) process.stderr.write(`Could not open browser (${cmd}): ${err.message}\n`);
L12419: });
...
L12429: function togglOAuthLocalRedirectUri(port = TOGGL_OAUTH_CALLBACK_PORT) {
L12430: return `http://localhost:${port}/callback`;
L12431: }
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
build/program-Bq2_rov1.jsView on unpkg · L1241612416Trigger-reachable command-output exfiltration chain: manifest.exports -> build/index.js -> build/program-Bq2_rov1.js
L12416: const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start \"\"" : "xdg-open";
L12417: exec(`${cmd} "${url}"`, (err) => {
L12418: if (err) process.stderr.write(`Could not open browser (${cmd}): ${err.message}\n`);
L12419: });
...
L12429: function togglOAuthLocalRedirectUri(port = TOGGL_OAUTH_CALLBACK_PORT) {
L12430: return `http://localhost:${port}/callback`;
L12431: }
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
build/program-Bq2_rov1.jsView on unpkg · L12416Findings
5 High2 Medium5 Low
HighChild Processbuild/program-Bq2_rov1.js
HighShellbuild/program-Bq2_rov1.js
HighCredential Redirect Persistencebuild/program-Bq2_rov1.js
HighCommand Output Exfiltrationbuild/program-Bq2_rov1.js
HighTrigger Reachable Command Output Exfiltrationbuild/program-Bq2_rov1.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @togglhq/cli@1.13.160.
See all versions of @togglhq/cli for other recorded verdicts.
- Review the evidence and your use of @togglhq/cli@1.13.160 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.