registry  /  @threadbase-sh/streamer  /  1.27.3

@threadbase-sh/streamer@1.27.3

PTY session management, WebSocket streaming, and REST API server for Claude Code conversations

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
Explicit execution of dist/seed-claude-config.cjs with CLAUDE_CONFIG set.
Impact
A deployment that explicitly runs the helper can suppress Claude onboarding and workspace/API-key approval prompts for its configured /data environment.
Mechanism
Claude configuration seeding plus user-invoked PTY, updater, and service management.
Rationale
The scanner's lifecycle block signal is unsupported by the shipped source: the referenced preinstall file is absent and postinstall only fixes node-pty helper permissions. The explicit config-seeding helper is a real AI-agent control-surface capability, but its bounded, non-lifecycle deployment use warrants a warning rather than a block.
Evidence
package.jsondist/seed-claude-config.cjsdist/cli.cjsdist/index.cjs
Network endpoints1
api.github.com

Decision evidence

public snapshot
AI called this Suspicious at 84.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
  • dist/seed-claude-config.cjs can modify a Claude config path supplied through CLAUDE_CONFIG.
  • That script marks /data/.claude/projects trusted and records a custom API-key approval suffix.
  • dist/cli.cjs provides explicit update/install and service lifecycle capabilities.
Evidence against
  • package.json postinstall only attempts chmod on node-pty's platform helper; it does not alter agent settings.
  • package.json preinstall references scripts/check-native-abi.mjs, which is absent from the shipped package.
  • seed-claude-config.cjs runs only behind a require.main guard; it is not an install or import hook.
  • The PTY launcher invokes the Claude executable with acceptEdits, not a skip-permissions mode.
  • Updater networking is explicit CLI update behavior and targets GitHub Releases with manifest/download handling.
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 4 file(s), 1.45 MB of source, external domains: github.com, json-schema.org
Oversized source lightweight scan
dist/cli.cjs6.87 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsCryptoHighEntropyStrings

Source & flagged code

7 flagged · loading source
package.jsonView file
•scripts.postinstall = node -e "try{require('fs').chmodSync(require('path').join(require.resolve('node-pty'),'..','..','prebuilds',process.platform+'-'+process.arch,'spawn-helper'),0o755)}catch{}"
Critical
Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg
•scripts.preinstall = node scripts/check-native-abi.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
dist/index.jsView file
547// src/platform.ts L548: import { execFileSync } from "child_process"; L549: import { existsSync } from "fs";
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L547
55} L56: function readAgentConfig(env = process.env) { L57: const enabled = isTruthy(env.MULTI_AGENT_FLOW); ... L160: try { L161: return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected)); L162: } catch { ... L179: const app = new Hono(); L180: app.post("/sessions/:sessionId/progress", async (c) => { L181: if (!deps.agentConfig.enabled) { ... L281: function configDir() { L282: return process.env.THREADBASE_CONFIG_DIR ?? join2(homedir(), ".threadbase"); L283: }
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L55
dist/index.cjsView file
106Cross-file remote execution chain: dist/index.cjs spawns dist/index.js; helper contains network access plus dynamic code execution. L106: } L107: function readAgentConfig(env = process.env) { L108: const enabled = isTruthy(env.MULTI_AGENT_FLOW); ... L211: try { L212: return import_node_crypto.default.timingSafeEqual(Buffer.from(signature), Buffer.from(expected)); L213: } catch { ... L230: const app = new import_hono.Hono(); L231: app.post("/sessions/:sessionId/progress", async (c) => { L232: if (!deps.agentConfig.enabled) { ... L332: function configDir() { L333: return process.env.THREADBASE_CONFIG_DIR ?? (0, import_path.join)((0, import_os.homedir)(), ".threadbase"); L334: }
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.cjsView on unpkg · L106
dist/cli.cjsView file
•path = dist/cli.cjs kind = oversized_source_file sizeBytes = 7204084 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.cjsView on unpkg
•path = dist/cli.cjs kind = oversized_cli_entrypoint sizeBytes = 7204084 magicHex = [redacted]
Medium
Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.cjsView on unpkg

Findings

1 Critical5 High4 Medium6 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShell
HighCross File Remote Execution Contextdist/index.cjs
HighOversized Source Filedist/cli.cjs
MediumNetwork
MediumEnvironment Vars
MediumOversized Cli Entrypointdist/cli.cjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings