@threadlines/server@0.3.8
Threadlines server and CLI for running coding-agent sessions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe inspected credential and process-execution paths were consistent with the package’s coding-agent server purpose, and no credential redirect was confirmed. However, default-on runtime analytics is not disclosed in the README, so this is suspicious telemetry rather than a clean result.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
When the server’s analytics service starts and records events; buffered batches are flushed in the background.
Impact
The publisher receives usage events and basic runtime metadata without clear disclosure in the package README.
Mechanism
The service posts event data with a hashed random installation identifier and runtime metadata to the configured PostHog host, defaulting to us.i.posthog.com. Settings and an environment variable can disable it.
AI rationale
The inspected credential and process-execution paths were consistent with the package’s coding-agent server purpose, and no credential redirect was confirmed. However, default-on runtime analytics is not disclosed in the README, so this is suspicious telemetry rather than a clean result.
Evidence
dist/bin.mjs
Network endpoints1
us.i.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Runtime usage analytics defaults to enabled when no setting overrides it.
- The server sends analytics batches to PostHog, including an installation identifier, event properties, platform, architecture, and package version.
- The identifier is generated randomly, stored in the server state directory, and hashed before use.
Evidence against
- The manifest has no lifecycle scripts; the package exposes a CLI for a coding-agent server.
- Telemetry can be disabled through a settings value or THREADLINES_TELEMETRY_ENABLED.
- The README describes the package’s server and CLI purpose; no credential redirection or unrelated collector was confirmed in the inspected paths.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinified
Source & flagged code
12 flaggeddist/shell-CoqLTl_A.mjsView file
2L3: import { execFileSync } from "node:child_process";
L4: import { accessSync, constants, statSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/shell-CoqLTl_A.mjsView on unpkg · L210const POSIX_PATH_DELIMITER = ":";
L11: const WINDOWS_SHELL_CANDIDATES = ["pwsh.exe", "powershell.exe"];
L12: const defaultCommandFileSystem = {
High
dist/client/assets/SourceControlPanel-3TtEveDq.jsView file
172contains invisible/control Unicode U+200E (left-to-right mark)
`,FP=TP?`\xA0`:NP,IP=`֑-߿יִ-﷽ﹰ-ﻼ`,LP=`A-Za-zÀ-ÖØ-öø-ʸ̀-ࠀ-<U+200E>Ⰰ-︀--`;RegExp(`^[^`+LP+`]*[`+IP+`]`),RegExp(`^[^`+IP+`]*[`+LP+`]`);var RP={bold:1,capitalize:1024,code:16,highlight:128,italic:2,lowercase:256,strikethrough:4,subscript:3
Findings
2 Critical6 High7 Medium4 Low
CriticalTrojan Source Unicodedist/client/assets/SourceControlPanel-3TtEveDq.js
CriticalPrevious Version Dangerous Deltadist/bin.mjs
HighChild Processdist/shell-CoqLTl_A.mjs
HighShelldist/shell-CoqLTl_A.mjs
HighCredential Redirect Persistencedist/bin.mjs
HighCommand Output Exfiltrationdist/bin.mjs
HighRemote Agent Bridgedist/bin.mjs
HighSemantic Analysis Limiteddist/bin.mjs
MediumDynamic Requiredist/client/assets/sass-DXrisJhu.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumOversized Source File
Affected versions and remediation
This report applies to @threadlines/server@0.3.8.
See all versions of @threadlines/server for other recorded verdicts.
- Review the evidence and your use of @threadlines/server@0.3.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.