@threadlines/server@0.2.3
Threadlines server and CLI for running coding-agent sessions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiNo malicious install-time or covert attack chain is present. Per policy, the explicit runtime capability to alter external AI-agent extensions warrants a non-blocking warning.
Static reason
No blocking static signals were detected.
Trigger
User runs `threadlines` and requests a provider plugin install, enablement change, update, or uninstall through its local server.
Impact
Can modify the selected coding-agent provider's plugin or extension configuration under the requested scope.
Mechanism
Explicit runtime delegation to Codex/Claude extension-management commands.
AI rationale
No malicious install-time or covert attack chain is present. Per policy, the explicit runtime capability to alter external AI-agent extensions warrants a non-blocking warning.
Evidence
package.jsondist/bin.mjsREADME.md~/.codex~/.claude
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- `dist/bin.mjs` exposes RPC actions to install, uninstall, enable, and update Codex/Claude plugins.
- Plugin actions delegate to provider CLIs/app-server APIs and can write provider extension configuration.
- The CLI can launch coding-agent sessions and PTYs after the user starts the server.
Evidence against
- `package.json` has no preinstall, install, postinstall, prepare, or other lifecycle hook.
- `dist/bin.mjs` runs its CLI only under `import.meta.main`; importing the package does not start it.
- Agent plugin mutation is tied to explicit authenticated runtime RPC requests, not installation.
- `dist/bin.mjs` stores server state under its own configured state directory and protects secret files with restrictive modes.
- Observed network references are local server/provider functionality; no covert exfiltration endpoint was found.
- The scanned `eval`/dynamic-import indicators are bundled UI/runtime patterns, not a payload execution chain.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
5 flaggeddist/client/assets/SourceControlPanel-EN5MS7GV.jsView file
167`)}function nte(e,t){let n=t?.maxLines??8,r=Bx(e).trimEnd().split(/\r?\n/).map(e=>e.trimEnd()),i=[],a=0,o=!1;for(let e of r){let t=e.trim().length>0;if(t&&a>=n){o=!0;break}i.push(e...
L168: `))}function rte(e){let t=e.toLowerCase().replace(/[`'".,!?()[\]{}]+/g,``).replace(/[^a-z0-9]+/g,`-`).replace(/^-+|-+$/g,``);return t.length>0?t:`plan`}function Vx(e){return`PLEASE...
L169:
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/client/assets/SourceControlPanel-EN5MS7GV.jsView on unpkg · L167dist/client/assets/tsx-L4OCAKyt.jsView file
1import{hd as e}from"./preload-helper-DKWso-T1.js";var t=e({default:()=>n}),n=[Object.freeze(JSON.parse(`{"displayName":"TSX","name":"tsx","patterns":[{"include":"#directives"},{"in...
L2: //# sourceMappingURL=tsx-L4OCAKyt.js.map
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/client/assets/tsx-L4OCAKyt.jsView on unpkg · L1Findings
2 High6 Medium5 Low
HighShips High Entropy Blobdist/client/assets/cascadia-mono-vietnamese-wght-normal-B9mnRIIc.woff2
HighOversized Source Filedist/bin.mjs
MediumDynamic Requiredist/client/assets/tsx-L4OCAKyt.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumOversized Cli Entrypointdist/bin.mjs
MediumStructural Risk Force Deep Review
LowEvaldist/client/assets/SourceControlPanel-EN5MS7GV.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @threadlines/server@0.2.3.
See all versions of @threadlines/server for other recorded verdicts.
- Review the evidence and your use of @threadlines/server@0.2.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.