@threadlines/server@0.3.1
Threadlines server and CLI for running coding-agent sessions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner's command-output exfiltration claim is not supported by the inspected execution paths. This is a legitimate but high-capability agent orchestration package with default telemetry, so warn rather than block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs the threadlines CLI and uses its server/UI features.
Impact
High-capability local agent actions are available after explicit runtime use; operational metadata leaves the host.
Mechanism
Local agent orchestration plus default-enabled telemetry
AI rationale
The scanner's command-output exfiltration claim is not supported by the inspected execution paths. This is a legitimate but high-capability agent orchestration package with default telemetry, so warn rather than block.
Evidence
package.jsonREADME.mddist/bin.mjsdist/shell-DamM0QVE.mjsdist/NodePTY-C16is8Ga.mjs
Network endpoints2
us.i.posthog.com/batch/registry.npmjs.org/
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- dist/bin.mjs launches configured Codex/Claude CLI processes and exposes agent/browser tooling.
- dist/bin.mjs permits user-requested project AGENTS.md or CLAUDE.md writes.
- dist/bin.mjs enables PostHog telemetry by default and posts runtime event metadata.
- Telemetry includes hashed installation ID, platform, architecture, project/thread counts, and provider events.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The only package entrypoint is the explicit threadlines CLI.
- Process execution is runtime functionality for a coding-agent server, not install-time behavior.
- Telemetry endpoint and payload are declared; no command-output upload or stealth endpoint was found.
- Agent instruction-file writes are project-root constrained and exposed through an authenticated RPC handler.
- Telemetry can be disabled through settings or THREADLINES_TELEMETRY_ENABLED.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
8 flaggeddist/shell-DamM0QVE.mjsView file
2L3: import { execFileSync } from "node:child_process";
L4: import { accessSync, constants, statSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/shell-DamM0QVE.mjsView on unpkg · L210const POSIX_PATH_DELIMITER = ":";
L11: const WINDOWS_SHELL_CANDIDATES = ["pwsh.exe", "powershell.exe"];
L12: function trimNonEmpty(value) {
High
dist/bin.mjsView file
2L3: import { a as readPathFromLaunchctl, c as resolveWindowsEnvironment, i as readEnvironmentFromWindowsShell, n as listLoginShellCandidates, o as readPathFromLoginShell, r as mergePat...
L4: import { n as PtySpawnError, t as PtyAdapter } from "./PTY-B_NJr7la.mjs";
...
L9: import { Argument, Command, Flag, GlobalFlag } from "effect/unstable/cli";
L10: import * as NodeNet from "node:net";
L11: import * as Data from "effect/Data";
...
L38: import * as Migrator from "effect/unstable/sql/Migrator";
L39: import { execFileSync } from "node:child_process";
L40: import * as Cause from "effect/Cause";
...
L203: //#endregion
L204: //#region package.json
L205: var version = "0.3.1";
Findings
3 Critical4 High6 Medium5 Low
CriticalCommand Output Exfiltrationdist/bin.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/bin.mjs
CriticalPrevious Version Dangerous Deltadist/NodePTY-C16is8Ga.mjs
HighChild Processdist/shell-DamM0QVE.mjs
HighShelldist/shell-DamM0QVE.mjs
HighRemote Agent Bridgedist/bin.mjs
HighTrigger Reachable Persistencedist/bin.mjs
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/bin.mjs
MediumProtestware
MediumStructural Risk Force Deep Review
LowEval
Affected versions and remediation
This report applies to @threadlines/server@0.3.1.
See all versions of @threadlines/server for other recorded verdicts.
- Review the evidence and your use of @threadlines/server@0.3.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.