registry / @threadlines/server / 0.5.0
@threadlines/server@0.5.0
Threadlines server and CLI for running coding-agent sessions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe manifest has no install hooks, and the published CLI loads its server bundle when invoked. Review of the flagged gateway, credential, shell, and Unicode locations found behavior consistent with agent setup and provider use, with no concrete unauthorized credential transfer or other attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user invokes the `threadlines` CLI or uses its server features.
Impact
Observed process, network, and credential handling is consistent with the package’s stated purpose; no unauthorized collection or redirection was found.
Mechanism
The CLI loads its server bundle, which launches configured agent tools and makes provider-related requests for their intended functions.
AI rationale
The manifest has no install hooks, and the published CLI loads its server bundle when invoked. Review of the flagged gateway, credential, shell, and Unicode locations found behavior consistent with agent setup and provider use, with no concrete unauthorized credential transfer or other attack.
Evidence
~/.claude/.credentials.jsonauth.json
Network endpoints4
api.anthropic.com/api/oauth/usageai-gateway.vercel.sh/v1/modelsfx.sh/setup.shcursor.com/install
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and declares no lifecycle scripts.
- The CLI loads the server bundle only when the command is invoked.
- The `fx` integration documents its own login flow and forwards only `fx` credential variables to that process.
- The Gateway request fetches a public model catalog; Claude usage is requested from Anthropic’s API.
- The flagged Unicode marks appear in a frontend text-processing regular expression.
Evidence against
- The package supports coding-agent sessions, so process execution and passing selected provider credentials to the chosen agent are consistent with its purpose.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
9 flaggeddist/bin-CtPhWdME.mjsView file
38import * as Migrator from "effect/unstable/sql/Migrator";
L39: import * as childProcess from "node:child_process";
L40: import { execFileSync } from "node:child_process";
High
Child Process
Package source references child process execution.
dist/bin-CtPhWdME.mjsView on unpkg · L38•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/bin-CtPhWdME.mjs:
import * as readline from "node:readline";
var NetService = class extends Context.Service()("@[redacted]") {};
threadlinesHome: Schema.String,
const DESKTOP_LAUNCH_ID_HEADER = "x-threadlines-desktop-launch-id";
httpBaseUrl: TrimmedNonEmptyString,
wsBaseUrl: TrimmedNonEmptyString,
return `No Threadlines desktop window is showing this thread, so ${this.operation} has nothing to act on. The browser panel opens itself once the user views this thread in the desk...
httpBaseUrl: Schema.NullOr(Schema.String),
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/bin-CtPhWdME.mjsView on unpkg9import { Argument, Command, Flag, GlobalFlag } from "effect/unstable/cli";
L10: import * as NodeNet from "node:net";
L11: import * as Data from "effect/Data";
...
L38: import * as Migrator from "effect/unstable/sql/Migrator";
L39: import * as childProcess from "node:child_process";
L40: import { execFileSync } from "node:child_process";
...
L588: "core",
L589: "private-network",
L590: "tunnel",
...
L1182: const [redacted] = Schema.Struct({
L1183: /** Base64 PNG, so it can go back as an image block the model actually sees. */
L1184: data: Schema.String,
Findings
2 Critical6 High5 Medium4 Low
CriticalTrojan Source Unicodedist/client/assets/SourceControlPanel-Bq4pkjHH.js
CriticalPrevious Version Dangerous Deltadist/NodePTY-BI7kHs1r.mjs
HighChild Processdist/bin-CtPhWdME.mjs
HighShell
HighCredential Redirect Persistencedist/bin-CtPhWdME.mjs
HighCommand Output Exfiltrationdist/bin-CtPhWdME.mjs
HighRemote Agent Bridgedist/bin-CtPhWdME.mjs
HighSemantic Analysis Limiteddist/bin-CtPhWdME.mjs
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/bin-CtPhWdME.mjs
MediumOversized Cli Entrypointdist/bin-CtPhWdME.mjs
Affected versions and remediation
This report applies to @threadlines/server@0.5.0.
See all versions of @threadlines/server for other recorded verdicts.
- Review the evidence and your use of @threadlines/server@0.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.