@threadlines/server@0.4.1
Threadlines server and CLI for running coding-agent sessions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe source implements runtime PostHog telemetry that is enabled by default, while the README search found no disclosure. The credential flow examined targets Anthropic’s official usage endpoint, so the scanner’s foreign-gateway lead was not confirmed.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The CLI starts its analytics service and records events while telemetry is enabled by default.
Impact
Users may have usage events and a pseudonymous installation identifier transmitted without clear disclosure or opt-in.
Mechanism
The service batches events with a persistent random installation identifier and platform, architecture, package version and client type, then posts them to PostHog.
AI rationale
The source implements runtime PostHog telemetry that is enabled by default, while the README search found no disclosure. The credential flow examined targets Anthropic’s official usage endpoint, so the scanner’s foreign-gateway lead was not confirmed.
Evidence
dist/bin.mjs
Network endpoints1
us.i.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Telemetry is enabled by default when settings are absent or omit the setting.
- The CLI sends event batches with a random installation identifier and platform, architecture, version and client type to PostHog.
- The README search found no telemetry disclosure; the package manifest exposes a CLI for coding-agent sessions.
Evidence against
- Claude usage credentials are sent to Anthropic’s official OAuth usage endpoint.
- The package description and CLI entry point match a coding-agent server and CLI.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Oversized source lightweight scan
dist/bin.mjs5.11 MB file, sampled 256 KB
FilesystemChildProcessCryptoShellHighEntropyStrings
Source & flagged code
9 flaggeddist/shell-ZyIy1B6R.mjsView file
2L3: import { execFileSync } from "node:child_process";
L4: import { accessSync, constants, statSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/shell-ZyIy1B6R.mjsView on unpkg · L2dist/bin.mjsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/bin.mjs:
import * as readline from "node:readline";
var NetService = class extends Context.Service()("@[redacted]") {};
threadlinesHome: Schema.String,
const DESKTOP_LAUNCH_ID_HEADER = "x-threadlines-desktop-launch-id";
httpBaseUrl: TrimmedNonEmptyString,
wsBaseUrl: TrimmedNonEmptyString,
return `No Threadlines desktop window is showing this thread, so ${this.operation} has nothing to act on. The browser panel opens itself once the user views this thread in the desk...
httpBaseUrl: Schema.NullOr(Schema.String),
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/bin.mjsView on unpkg2L3: import { a as readPathFromLaunchctl, c as resolveCommandPath, i as readEnvironmentFromWindowsShell, l as resolveWindowsEnvironment, n as listLoginShellCandidates, o as readPathFrom...
L4: import { n as PtySpawnError, t as PtyAdapter } from "./PTY-WMZ67D53.mjs";
...
L10: import { Argument, Command, Flag, GlobalFlag } from "effect/unstable/cli";
L11: import * as NodeNet from "node:net";
L12: import * as Data from "effect/Data";
...
L39: import * as Migrator from "effect/unstable/sql/Migrator";
L40: import * as childProcess from "node:child_process";
L41: import { execFileSync } from "node:child_process";
...
L239: //#endregion
L240: //#region package.json
L241: var version = "0.4.1";
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/bin.mjsView on unpkg · L239import * as Migrator from "effect/unstable/sql/Migrator";
L40: import * as childProcess from "node:child_process";
L41: import { execFileSync } from "node:child_process";
...
L618: provider: AdvertisedEndpointProvider,
L619: httpBaseUrl: TrimmedNonEmptyString,
L620: wsBaseUrl: TrimmedNonEmptyString,
...
L14965: try {
L14966: return JSON.parse(readFileSync(packageJsonPath, "utf8")).version ?? "unknown";
L14967: } catch {
...
L64383:
L64384: Use the \`request_user_input\` tool only when it is listed in the available tools for this turn.
L64385:
High
Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/bin.mjsView on unpkg · L39•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/bin.mjsView on unpkg•path = dist/bin.mjs
kind = oversized_source_file
sizeBytes = 5363254
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/bin.mjsView on unpkg•path = dist/bin.mjs
kind = oversized_cli_entrypoint
sizeBytes = 5363254
magicHex = [redacted]
Medium
Oversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
dist/bin.mjsView on unpkgdist/client/assets/SourceControlPanel-D5QlugUx.jsView file
10contains invisible/control Unicode U+200E (left-to-right mark)
`,oT=Vw?`\xA0`:iT,sT=`֑-߿יִ-﷽ﹰ-ﻼ`,cT=`A-Za-zÀ-ÖØ-öø-ʸ̀-ࠀ-<U+200E>Ⰰ-︀--`;RegExp(`^[^`+cT+`]*[`+sT+`]`),RegExp(`^[^`+sT+`]*[`+cT+`]`);var lT={bold:1,capitalize:1024,code:16,highlight:128,italic:2,lowercase:256,strikethrough:4,subscript:3
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/client/assets/SourceControlPanel-D5QlugUx.jsView on unpkg · L10dist/NodePTY-D8gtjJSu.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @threadlines/server@0.3.6
matchedIdentity = npm:QHRocmVhZGxpbmVzL3NlcnZlcg:0.3.6
similarity = 0.458
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/NodePTY-D8gtjJSu.mjsView on unpkgFindings
2 Critical6 High5 Medium4 Low
CriticalTrojan Source Unicodedist/client/assets/SourceControlPanel-D5QlugUx.js
CriticalPrevious Version Dangerous Deltadist/NodePTY-D8gtjJSu.mjs
HighChild Processdist/shell-ZyIy1B6R.mjs
HighShell
HighCredential Redirect Persistencedist/bin.mjs
HighCommand Output Exfiltrationdist/bin.mjs
HighRemote Agent Bridgedist/bin.mjs
HighSemantic Analysis Limiteddist/bin.mjs
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/bin.mjs
MediumOversized Cli Entrypointdist/bin.mjs
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @threadlines/server@0.4.1.
See all versions of @threadlines/server for other recorded verdicts.
- Review the evidence and your use of @threadlines/server@0.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.