registry / @threadlines/server / 0.3.0
@threadlines/server@0.3.0
Threadlines server and CLI for running coding-agent sessions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiStatic hints correctly identify terminal, process, network, and optional remote-access features, but source inspection shows they are package-aligned runtime capabilities rather than a covert malicious chain. No lifecycle execution, credential harvesting, fixed exfiltration endpoint, or stealth persistence was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs the threadlines CLI/server and connects an authorized client.
Impact
Authorized users can operate terminals and project files through the server; no unconsented install-time action or covert data export was found.
Mechanism
authenticated local workspace, terminal, and coding-agent orchestration
AI rationale
Static hints correctly identify terminal, process, network, and optional remote-access features, but source inspection shows they are package-aligned runtime capabilities rather than a covert malicious chain. No lifecycle execution, credential harvesting, fixed exfiltration endpoint, or stealth persistence was found.
Evidence
package.jsonREADME.mddist/bin.mjs
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no preinstall/install/postinstall lifecycle hooks.
- dist/bin.mjs runs only as the explicit CLI entrypoint via import.meta.main.
- README.md describes an interactive local coding-agent server/CLI.
- Terminal PTY and command execution are runtime features of that user-started server.
- Remote access uses pairing/session authentication; no hard-coded exfiltration endpoint was found.
- OTLP destinations are optional user-provided configuration, not package-controlled hosts.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
Source & flagged code
7 flaggeddist/bin.mjsView file
8import { Argument, Command, Flag, GlobalFlag } from "effect/unstable/cli";
L9: import * as NodeNet from "node:net";
L10: import * as Data from "effect/Data";
...
L37: import * as Migrator from "effect/unstable/sql/Migrator";
L38: import { execFileSync } from "node:child_process";
L39: import * as Cause from "effect/Cause";
...
L201: //#endregion
L202: //#region package.json
L203: var version = "0.3.0";
...
L1064: const [redacted] = Schema.Struct({
L1065: /** Base64 PNG, so it can go back as an image block the model actually sees. */
L1066: data: Schema.String,
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/bin.mjsView on unpkg · L88Trigger-reachable chain: manifest.bin -> dist/bin.mjs
L8: import { Argument, Command, Flag, GlobalFlag } from "effect/unstable/cli";
L9: import * as NodeNet from "node:net";
L10: import * as Data from "effect/Data";
...
L37: import * as Migrator from "effect/unstable/sql/Migrator";
L38: import { execFileSync } from "node:child_process";
L39: import * as Cause from "effect/Cause";
...
L201: //#endregion
L202: //#region package.json
L203: var version = "0.3.0";
...
L1064: const [redacted] = Schema.Struct({
L1065: /** Base64 PNG, so it can go back as an image block the model actually sees. */
L1066: data: Schema.String,
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/bin.mjsView on unpkg · L8Findings
3 Critical3 High6 Medium5 Low
CriticalCommand Output Exfiltrationdist/bin.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/bin.mjs
CriticalPrevious Version Dangerous Deltadist/bin.mjs
HighChild Processdist/bin.mjs
HighShelldist/bin.mjs
HighRemote Agent Bridgedist/bin.mjs
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/bin.mjs
MediumProtestware
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowObfuscated
Affected versions and remediation
This report applies to @threadlines/server@0.3.0.
See all versions of @threadlines/server for other recorded verdicts.
- Review the evidence and your use of @threadlines/server@0.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.