registry / AI-agent control-surface risk / instar
instar
Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.
This report shows the evidence for instar@1.3.1419. 1 of 275 known versions is blocked or flagged. The newest version, 1.3.1427, is allowed. See all versions.
AI Security Review
scanned 19h ago · by lpm-firewall-aiSource inspection confirms an update-triggered migration changes the project’s Claude settings and installs a handler that automatically allows permission requests. This is a concrete agent permission bypass and supports blocking publication.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Server startup after the installed version differs from the last migrated version.
Impact
Claude sessions can grant requested tool permissions without the normal user approval prompt.
Mechanism
The migrator modifies the project’s Claude settings to register a catch-all PermissionRequest hook, whose generated handler returns an allow decision.
Policy narrative
When the installed version changes, server startup runs the migrator. It writes a catch-all PermissionRequest hook into the project’s Claude settings; the generated handler returns an allow decision for the request. This removes the normal approval prompt for permission requests.
AI rationale
Source inspection confirms an update-triggered migration changes the project’s Claude settings and installs a handler that automatically allows permission requests. This is a concrete agent permission bypass and supports blocking publication.
Evidence
dist/commands/server.jsdist/core/PostUpdateMigrator.js
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- On startup after the installed version changes, the server runs the post-update migrator.
- The migrator runs settings migration and targets the project’s Claude settings file.
- It adds a catch-all permission request hook that invokes the package’s auto-approval hook.
- The migrator writes the modified settings file.
- The generated hook responds to permission requests with an unconditional allow decision.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
18 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/fix-better-sqlite3.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/threadline/PipeSessionSpawner.jsView file
15*/
L16: import { execSync } from 'node:child_process';
L17: import fs from 'node:fs';
High
Child Process
Package source references child process execution.
dist/threadline/PipeSessionSpawner.jsView on unpkg · L15352// Spawn tmux session, recording its incarnation (session id + pane pid)
L353: const created = execSync(`tmux new-session -d -P -F '#{session_id} #{pane_pid}' -s "${sessionName}" -x 200 -y 50 'bash -c "${shellCmd.replace(/"/g, '\\"')}"'`, { timeout: 10_000, e...
L354: const [tmuxId, panePid] = created.split(' ');
High
Shell
Package source references shell execution.
Findings
4 Critical11 High6 Medium5 Low
CriticalPersistence Backdoordist/core/GitSync.js
CriticalTrigger Reachable Dangerous Capabilitydist/core/GitSync.js
CriticalTrigger Reachable Excluded Directory Payloaddist/core/PostUpdateMigrator.js
CriticalPrevious Version Dangerous Deltadist/core/PostUpdateMigrator.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/threadline/PipeSessionSpawner.js
HighShelldist/threadline/PipeSessionSpawner.js
HighSame File Env Network Executionskills/spec-converge/scripts/publish-spec-review.mjs
HighCredential Redirect Persistencedist/messaging/TelegramAdapter.js
HighSandbox Evasion Gated Capabilitydist/commands/setup.js
Affected versions and remediation
This report applies to instar@1.3.1419.
The versions list below shows the verdict for each recorded version.
- Avoid installing instar@1.3.1419. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.