registry / @threadlines/server / 0.4.0
@threadlines/server@0.4.0
Threadlines server and CLI for running coding-agent sessions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package provides a coding-agent server CLI, and its reviewed credential and network flows are consistent with that purpose. Its analytics use a hashed random install identifier, and the source reviewed does not substantiate the scanner’s credential-redirection claim.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Normal CLI or server operation.
Impact
No malicious impact identified.
Mechanism
The source checks Claude usage at Anthropic and sends usage event metadata to PostHog with a hashed random install identifier. No reviewed source established credential redirection or exfiltration.
AI rationale
The package provides a coding-agent server CLI, and its reviewed credential and network flows are consistent with that purpose. Its analytics use a hashed random install identifier, and the source reviewed does not substantiate the scanner’s credential-redirection claim.
Network endpoints2
api.anthropic.com/api/oauth/usageus.i.posthog.com/batch/
Decision evidence
public snapshotAI called this Clean at 81.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a Threadlines server CLI and declares no install lifecycle scripts.
- Claude usage checks target Anthropic’s own OAuth usage endpoint.
- Runtime analytics sends event metadata to PostHog using a random install ID hashed before transmission.
- The CLI strips Claude token and API key environment variables before running its normal-auth status check.
Evidence against
- The package runs local agent and shell processes as part of its coding-agent server purpose.
- The static routing hints flag a credential redirect, but the reviewed source excerpts do not substantiate a fixed unofficial gateway or credential redirection.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
12 flaggeddist/shell-ZyIy1B6R.mjsView file
2L3: import { execFileSync } from "node:child_process";
L4: import { accessSync, constants, statSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/shell-ZyIy1B6R.mjsView on unpkg · L210const POSIX_PATH_DELIMITER = ":";
L11: const WINDOWS_SHELL_CANDIDATES = ["pwsh.exe", "powershell.exe"];
L12: const defaultCommandFileSystem = {
High
dist/client/assets/SourceControlPanel-DLt_8sRC.jsView file
10contains invisible/control Unicode U+200E (left-to-right mark)
`,sw=HC?`\xA0`:aw,cw=`֑-߿יִ-﷽ﹰ-ﻼ`,lw=`A-Za-zÀ-ÖØ-öø-ʸ̀-ࠀ-<U+200E>Ⰰ-︀--`;RegExp(`^[^`+lw+`]*[`+cw+`]`),RegExp(`^[^`+cw+`]*[`+lw+`]`);var uw={bold:1,capitalize:1024,code:16,highlight:128,italic:2,lowercase:256,strikethrough:4,subscript:3
Findings
2 Critical6 High7 Medium4 Low
CriticalTrojan Source Unicodedist/client/assets/SourceControlPanel-DLt_8sRC.js
CriticalPrevious Version Dangerous Deltadist/NodePTY-D8gtjJSu.mjs
HighChild Processdist/shell-ZyIy1B6R.mjs
HighShelldist/shell-ZyIy1B6R.mjs
HighCredential Redirect Persistencedist/bin.mjs
HighCommand Output Exfiltrationdist/bin.mjs
HighRemote Agent Bridgedist/bin.mjs
HighSemantic Analysis Limiteddist/bin.mjs
MediumDynamic Requiredist/client/assets/sass-DXrisJhu.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumOversized Source File
Affected versions and remediation
This report applies to @threadlines/server@0.4.0.
See all versions of @threadlines/server for other recorded verdicts.
- Review the evidence and your use of @threadlines/server@0.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.