registry / @threadlines/server / 0.3.2
@threadlines/server@0.3.2
Threadlines server and CLI for running coding-agent sessions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiScanner claims of command-output exfiltration are not supported by the inspected source: command output is retained for local provider-update status. The observed process, credential, network, and filesystem capabilities are package-aligned and runtime/user-invoked.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Explicit execution of the threadlines CLI/server
Impact
No unconsented install-time action, exfiltration chain, or persistence was found.
Mechanism
Local agent orchestration, PTY terminal management, and opt-out telemetry
AI rationale
Scanner claims of command-output exfiltration are not supported by the inspected source: command output is retained for local provider-update status. The observed process, credential, network, and filesystem capabilities are package-aligned and runtime/user-invoked.
Evidence
package.jsondist/bin.mjsdist/shell-DamM0QVE.mjsdist/NodePTY-C16is8Ga.mjs
Network endpoints3
api.anthropic.com/api/oauth/usageus.i.posthog.com/batch/registry.npmjs.org/
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no lifecycle scripts; execution is via the user-invoked threadlines CLI.
- dist/bin.mjs starts only when import.meta.main and runs a local server/CLI.
- Shell and PTY execution implement the advertised coding-agent terminal feature.
- Claude OAuth credential reads are used only for an authenticated request to api.anthropic.com usage endpoint.
- PostHog telemetry uses an anonymous installation ID and feature-event metadata, not command output.
- No source evidence sends shell command output, harvested credentials, or files to an attacker endpoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
Source & flagged code
8 flaggeddist/shell-DamM0QVE.mjsView file
2L3: import { execFileSync } from "node:child_process";
L4: import { accessSync, constants, statSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/shell-DamM0QVE.mjsView on unpkg · L210const POSIX_PATH_DELIMITER = ":";
L11: const WINDOWS_SHELL_CANDIDATES = ["pwsh.exe", "powershell.exe"];
L12: function trimNonEmpty(value) {
High
dist/bin.mjsView file
2L3: import { a as readPathFromLaunchctl, c as resolveWindowsEnvironment, i as readEnvironmentFromWindowsShell, n as listLoginShellCandidates, o as readPathFromLoginShell, r as mergePat...
L4: import { n as PtySpawnError, t as PtyAdapter } from "./PTY-B_NJr7la.mjs";
...
L10: import { Argument, Command, Flag, GlobalFlag } from "effect/unstable/cli";
L11: import * as NodeNet from "node:net";
L12: import * as Data from "effect/Data";
...
L39: import * as Migrator from "effect/unstable/sql/Migrator";
L40: import { execFileSync } from "node:child_process";
L41: import * as Cause from "effect/Cause";
...
L204: //#endregion
L205: //#region package.json
L206: var version = "0.3.2";
Findings
3 Critical4 High6 Medium5 Low
CriticalCommand Output Exfiltrationdist/bin.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/bin.mjs
CriticalPrevious Version Dangerous Deltadist/bin.mjs
HighChild Processdist/shell-DamM0QVE.mjs
HighShelldist/shell-DamM0QVE.mjs
HighRemote Agent Bridgedist/bin.mjs
HighTrigger Reachable Persistencedist/bin.mjs
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/bin.mjs
MediumProtestware
MediumStructural Risk Force Deep Review
LowEval
Affected versions and remediation
This report applies to @threadlines/server@0.3.2.
See all versions of @threadlines/server for other recorded verdicts.
- Review the evidence and your use of @threadlines/server@0.3.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.