registry / @togglhq/cli / 1.13.76
@togglhq/cli@1.13.76
Toggl CLI for Toggl 2.0 API operations.
AI Security Review
scanned 8d ago · by lpm-firewall-aiSource inspection found no install-time hook or confirmed attack behavior. Scanner matches correspond to normal OAuth, product analytics, browser opening, and explicit CLI setup or update operations.
Static reason
One or more suspicious static signals were detected.
Trigger
A CLI invocation initializes analytics; the user runs the auth command to begin OAuth sign-in.
Impact
No source-backed credential theft, command-output exfiltration, or malicious persistence was identified. Auth profiles are saved to the stated local Toggl configuration file.
Mechanism
OAuth sends the authorization code to the configured Toggl Accounts endpoint. Analytics sends command name, action, outcome, and session metadata to the configured PostHog host, with an environment opt-out.
AI rationale
Source inspection found no install-time hook or confirmed attack behavior. Scanner matches correspond to normal OAuth, product analytics, browser opening, and explicit CLI setup or update operations.
Evidence
~/.toggl/focus-tools.json
Network endpoints2
accounts.toggl.com/api/oauth/tokeneu.i.posthog.com/i/v0/e/
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the CLI and declares build and development scripts, with no install lifecycle hook; the inspected runtime dependencies also contain no install hook.
- OAuth runs through the explicit auth command, exchanges its code with the configured Toggl Accounts endpoint, and saves the returned profile locally.
- Analytics sends a limited set of command and outcome fields to Toggl’s PostHog project; the inspected payload omits command arguments and results, and analytics can be disabled.
- The flagged dependency paths contain CLI prompt code and Sentry/OpenTelemetry exports or instrumentation, consistent with their declared package roles.
Evidence against
- The shell calls open the OAuth URL or run explicit setup and update commands with inherited standard I/O; no command-output upload path was found.
- The OAuth endpoint defaults to Toggl Accounts and can be configured; no fixed unofficial credential gateway or credential redirection was found.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
5 flaggedbuild/program-BklQ8ONG.jsView file
6import { fileURLToPath } from "node:url";
L7: import { exec, spawn } from "node:child_process";
L8: import process$1 from "node:process";
High
Child Process
Package source references child process execution.
build/program-BklQ8ONG.jsView on unpkg · L61830if (process$3.versions?.electron) parseOptions.from = "electron";
L1831: const execArgv = process$3.execArgv ?? [];
L1832: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) parseOptions.from = "eval";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
build/program-BklQ8ONG.js:
import * as readline from "node:readline";
import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
import { createInterface } from "node:readline/promises";
function readline$1() {
const cleanFn = cb(readline$1());
* Returns the width of the active readline, or 80 as default value.
function readlineWidth() {
output: readline$1().output
Findings
5 High2 Medium5 Low
HighChild Processbuild/program-BklQ8ONG.js
HighShellbuild/program-BklQ8ONG.js
HighCredential Redirect Persistencebuild/program-BklQ8ONG.js
HighCommand Output Exfiltrationbuild/program-BklQ8ONG.js
HighTrigger Reachable Command Output Exfiltrationbuild/program-BklQ8ONG.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @togglhq/cli@1.13.76.
See all versions of @togglhq/cli for other recorded verdicts.
- Review the evidence and your use of @togglhq/cli@1.13.76 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.