registry  /  @togglhq/mcp  /  1.5.37

@togglhq/mcp@1.5.37

⚠ Under review

Toggl 2.0 MCP server for Claude Code, Claude Desktop, and other MCP clients.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 3 file(s), 1.64 MB of source, external domains: accounts.toggl.com, datatracker.ietf.org, dotenvx.com, empty.invalid, example.com, focus.toggl.com, fonts.googleapis.com, fonts.gstatic.com, github.com, json-schema.org, raw.githubusercontent.com, react.dev, www.w3.org

Source & flagged code

8 flagged · loading source
build/src-7favWAYS.jsView file
9import { createInterface } from "node:readline/promises"; L10: import { exec } from "node:child_process"; L11: import * as http from "node:http"; L12: import "date-fns"; ... L68: //#endregion L69: //#region ../../node_modules/.pnpm/@dotenvx+dotenvx@1.59.1/node_modules/@dotenvx/dotenvx/package.json L70: var require_package = /* @__PURE__ */ __commonJSMin$1(((exports, module) => { ... L163: INVALID_CONVENTION: "https://github.com/dotenvx/dotenvx/issues/761", L164: INVALID_PRIVATE_KEY: "https://github.com/dotenvx/dotenvx/issues/465", L165: INVALID_PUBLIC_KEY: "https://github.com/dotenvx/dotenvx/issues/756", L166: MALFORMED_ENCRYPTED_DATA: "https://github.com/dotenvx/dotenvx/issues/467", L167: MISPAIRED_PRIVATE_KEY: "https://github.com/dotenvx/dotenvx/issues/752",
Critical
Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

build/src-7favWAYS.jsView on unpkg · L9
31817Trigger-reachable chain: manifest.exports -> build/index.js -> build/src-7favWAYS.js L31817: const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start \"\"" : "xdg-open"; L31818: exec(`${cmd} "${url}"`, (err) => { L31819: if (err) process.stderr.write(`Could not open browser (${cmd}): ${err.message}\n`); L31820: }); ... L31826: function togglOAuthLocalRedirectUri(port = TOGGL_OAUTH_CALLBACK_PORT) { L31827: return `http://localhost:${port}/callback`; L31828: }
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

build/src-7favWAYS.jsView on unpkg · L31817
9import { createInterface } from "node:readline/promises"; L10: import { exec } from "node:child_process"; L11: import * as http from "node:http";
High
Child Process

Package source references child process execution.

build/src-7favWAYS.jsView on unpkg · L9
110"eciesjs": "^0.4.10", L111: "execa": "^5.1.1", L112: "fdir": "^6.2.0",
High
Shell

Package source references shell execution.

build/src-7favWAYS.jsView on unpkg · L110
9678} L9679: eval(key, value) { L9680: return evalKeyValue(key, value, this.processEnv, this.runningParsed);
High
Eval

Package source references dynamic code evaluation.

build/src-7favWAYS.jsView on unpkg · L9678
31817const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start \"\"" : "xdg-open"; L31818: exec(`${cmd} "${url}"`, (err) => { L31819: if (err) process.stderr.write(`Could not open browser (${cmd}): ${err.message}\n`); L31820: }); ... L31826: function togglOAuthLocalRedirectUri(port = TOGGL_OAUTH_CALLBACK_PORT) { L31827: return `http://localhost:${port}/callback`; L31828: }
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

build/src-7favWAYS.jsView on unpkg · L31817
9import { createInterface } from "node:readline/promises"; L10: import { exec } from "node:child_process"; L11: import * as http from "node:http"; L12: import "date-fns"; ... L68: //#endregion L69: //#region ../../node_modules/.pnpm/@dotenvx+dotenvx@1.59.1/node_modules/@dotenvx/dotenvx/package.json L70: var require_package = /* @__PURE__ */ __commonJSMin$1(((exports, module) => { ... L163: INVALID_CONVENTION: "https://github.com/dotenvx/dotenvx/issues/761", L164: INVALID_PRIVATE_KEY: "https://github.com/dotenvx/dotenvx/issues/465", L165: INVALID_PUBLIC_KEY: "https://github.com/dotenvx/dotenvx/issues/756", L166: MALFORMED_ENCRYPTED_DATA: "https://github.com/dotenvx/dotenvx/issues/467", L167: MISPAIRED_PRIVATE_KEY: "https://github.com/dotenvx/dotenvx/issues/752",
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

build/src-7favWAYS.jsView on unpkg · L9
66}) : target, mod)); L67: var __require = /* @__PURE__ */ createRequire(import.meta.url); L68: //#endregion
Medium
Dynamic Require

Package source references dynamic require/import behavior.

build/src-7favWAYS.jsView on unpkg · L66

Findings

2 Critical5 High4 Medium5 Low
CriticalRemote Asset Decode Executebuild/src-7favWAYS.js
CriticalTrigger Reachable Dangerous Capabilitybuild/src-7favWAYS.js
HighChild Processbuild/src-7favWAYS.js
HighShellbuild/src-7favWAYS.js
HighEvalbuild/src-7favWAYS.js
HighCommand Output Exfiltrationbuild/src-7favWAYS.js
HighObfuscated Payload Loaderbuild/src-7favWAYS.js
MediumDynamic Requirebuild/src-7favWAYS.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License