registry / @togglhq/cli / 1.13.59
@togglhq/cli@1.13.59
Toggl CLI for Toggl 2.0 API operations.
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe scanner's subprocess and network signals correspond to CLI operations, Toggl authentication, and limited product analytics. The inspected source does not support the reported gateway credential redirect or command-output exfiltration, so the package is clean.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the CLI initializes telemetry; OAuth requests occur during authentication, and skill setup runs through the explicit skill command.
Impact
No command-output exfiltration, unrelated credential transfer, or install-time mutation was established.
Mechanism
Analytics sends allowlisted invocation fields and supports an environment opt-out. Authentication sends the authorization code to the configured Accounts URL.
AI rationale
The scanner's subprocess and network signals correspond to CLI operations, Toggl authentication, and limited product analytics. The inspected source does not support the reported gateway credential redirect or command-output exfiltration, so the package is clean.
Network endpoints3
eu.i.posthog.comaccounts.toggl.comfocus.toggl.com
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI entrypoint; the CLI initializes telemetry and parses user commands when run.
- OAuth exchanges send the authorization code to the configured Accounts URL, which defaults to Toggl Accounts.
- Telemetry can be disabled and sends an allowlisted set of tool, action, outcome, session, and version fields to the configured PostHog host.
- The required dependency excerpts show terminal prompting, tracing support, and a separate skills CLI; the package invokes skills setup through an explicit CLI command.
Evidence against
- The inspected source does not establish command-output forwarding or credential export to an unrelated gateway.
- The child-process calls inspected support user-invoked CLI features, including an explicit skill-install command.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
5 flaggedbuild/program-Nzh9v81h.jsView file
6import { fileURLToPath } from "node:url";
L7: import { exec, spawn } from "node:child_process";
L8: import process$1 from "node:process";
High
Child Process
Package source references child process execution.
build/program-Nzh9v81h.jsView on unpkg · L61830if (process$3.versions?.electron) parseOptions.from = "electron";
L1831: const execArgv = process$3.execArgv ?? [];
L1832: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) parseOptions.from = "eval";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
build/program-Nzh9v81h.js:
import * as readline from "node:readline";
import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
import { createInterface } from "node:readline/promises";
function readline$1() {
const cleanFn = cb(readline$1());
* Returns the width of the active readline, or 80 as default value.
function readlineWidth() {
output: readline$1().output
Findings
5 High2 Medium5 Low
HighChild Processbuild/program-Nzh9v81h.js
HighShellbuild/program-Nzh9v81h.js
HighCredential Redirect Persistencebuild/program-Nzh9v81h.js
HighCommand Output Exfiltrationbuild/program-Nzh9v81h.js
HighTrigger Reachable Command Output Exfiltrationbuild/program-Nzh9v81h.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @togglhq/cli@1.13.59.
See all versions of @togglhq/cli for other recorded verdicts.
- Review the evidence and your use of @togglhq/cli@1.13.59 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.