registry  /  @threadbase-sh/streamer  /  1.24.7

@threadbase-sh/streamer@1.24.7

PTY session management, WebSocket streaming, and REST API server for Claude Code conversations

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
Explicit execution of dist/seed-claude-config.cjs with CLAUDE_CONFIG set.
Impact
Can reduce Claude trust/onboarding prompts for the configured project in a deployment environment.
Mechanism
Claude trust-state configuration mutation
Rationale
The package is not concretely malicious by static inspection, but its explicit standalone Claude trust-config seeding is a meaningful AI-agent capability mutation. Flag it for warning rather than block because it is not install-triggered or stealthy.
Evidence
package.jsondist/seed-claude-config.cjsdist/index.cjsdist/cli.cjsREADME.md

Decision evidence

public snapshot
AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
  • dist/seed-claude-config.cjs writes a Claude config selected by CLAUDE_CONFIG.
  • That helper marks /data/.claude/projects trusted and accepts onboarding/trust dialogs.
  • It can record approval for a supplied CLAUDE_API_KEY suffix.
  • dist/cli.cjs contains explicit self-update and service-management commands.
Evidence against
  • package.json install hooks only check ABI, apply patches, and chmod node-pty's local helper.
  • seed-claude-config.cjs runs only when invoked as its own Node entrypoint; it is not a bin or lifecycle hook.
  • No source path showed install-time network access, payload execution, credential exfiltration, or foreign AI-agent mutation.
  • Runtime PTY spawning and localhost API/WebSocket behavior match the package's stated streamer purpose.
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 4 file(s), 1.41 MB of source, external domains: github.com, json-schema.org
Oversized source lightweight scan
dist/cli.cjs6.84 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsCryptoHighEntropyStrings

Source & flagged code

7 flagged · loading source
package.jsonView file
•scripts.postinstall = node -e "try{require('fs').chmodSync(require('path').join(require.resolve('node-pty'),'..','..','prebuilds',process.platform+'-'+process.arch,'spawn-helper'),0o755)}catch{}"
Critical
Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg
•scripts.postinstall = node -e "try{require('fs').chmodSync(require('path').join(require.resolve('node-pty'),'..','..','prebuilds',process.platform+'-'+process.arch,'spawn-helper'),0o755)}catch{}"
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
dist/index.jsView file
528// src/platform.ts L529: import { execFileSync } from "child_process"; L530: import { existsSync } from "fs";
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L528
55} L56: function readAgentConfig(env = process.env) { L57: const enabled = isTruthy(env.MULTI_AGENT_FLOW); ... L160: try { L161: return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected)); L162: } catch { ... L179: const app = new Hono(); L180: app.post("/sessions/:sessionId/progress", async (c) => { L181: if (!deps.agentConfig.enabled) { ... L281: function configDir() { L282: return process.env.THREADBASE_CONFIG_DIR ?? join2(homedir(), ".threadbase"); L283: }
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L55
dist/index.cjsView file
106Cross-file remote execution chain: dist/index.cjs spawns dist/index.js; helper contains network access plus dynamic code execution. L106: } L107: function readAgentConfig(env = process.env) { L108: const enabled = isTruthy(env.MULTI_AGENT_FLOW); ... L211: try { L212: return import_node_crypto.default.timingSafeEqual(Buffer.from(signature), Buffer.from(expected)); L213: } catch { ... L230: const app = new import_hono.Hono(); L231: app.post("/sessions/:sessionId/progress", async (c) => { L232: if (!deps.agentConfig.enabled) { ... L332: function configDir() { L333: return process.env.THREADBASE_CONFIG_DIR ?? (0, import_path.join)((0, import_os.homedir)(), ".threadbase"); L334: }
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.cjsView on unpkg · L106
dist/cli.cjsView file
•path = dist/cli.cjs kind = oversized_source_file sizeBytes = 7172974 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.cjsView on unpkg
•path = dist/cli.cjs kind = oversized_cli_entrypoint sizeBytes = 7172974 magicHex = [redacted]
Medium
Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.cjsView on unpkg

Findings

1 Critical5 High4 Medium6 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShell
HighCross File Remote Execution Contextdist/index.cjs
HighOversized Source Filedist/cli.cjs
MediumNetwork
MediumEnvironment Vars
MediumOversized Cli Entrypointdist/cli.cjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings