@threadlines/server
Threadlines server and CLI for running coding-agent sessions.
This report shows the evidence for @threadlines/server@0.8.0. 0 of 17 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe suspicious credential and network indicators resolve to a Claude usage feature that sends the stored Claude token to Anthropic’s official API. The flagged invisible character is a zero-width space in text-rendering logic, and the CLI entry point is gated on direct invocation.
Decision evidence
public snapshot- The manifest exposes a Threadlines CLI entry point.
- The CLI runs only when the bundle is invoked as the main module.
- Claude usage checks send a Claude access token to Anthropic’s official usage endpoint.
- The provider check obtains Claude’s stored sign-in for that usage check.
- The flagged invisible character is a zero-width space used in text-rendering logic, not a bidi control.
- The package reads a Claude credential and makes network requests as part of provider usage checks.
- The package includes large bundled files, limiting easy review of all code.
Source & flagged code
5 flaggedSource contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/client/assets/SourceControlPanel-CCWacH_A.jsView on unpkg · L29Package contains source files above the normal full-analysis size ceiling.
dist/bin-iAH2RUDM.mjsView on unpkgFindings
Affected versions and remediation
This report applies to @threadlines/server@0.8.0.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @threadlines/server@0.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.