instar@1.3.1338
Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe scanner’s malicious label is not supported by an inspected attack chain. Post-update installation of agent hooks is a real first-party extension capability, so a warning is appropriate while its registration and consent controls remain unresolved.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
An Instar post-update migration runs.
Impact
Those hooks may affect later agent sessions; no malicious effect is established by the inspected source.
Mechanism
The migrator writes hook scripts into the Instar hook directory.
AI rationale
The scanner’s malicious label is not supported by an inspected attack chain. Post-update installation of agent hooks is a real first-party extension capability, so a warning is appropriate while its registration and consent controls remain unresolved.
Evidence
dist/core/PostUpdateMigrator.js
Decision evidence
public snapshotAI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The declared postinstall runs a native dependency repair script; the manifest has no preinstall or install hook.
- The setup command selects an agent framework and announces that its launch mode can permit autonomous reading, writing, and execution.
- Post-update migration writes executable hook files into Instar’s agent hook directory.
- The inspected integration locations show framework-specific setup, migration, and session handling; they do not establish credential theft or a remote attack chain.
- The flagged synchronization and contract-test sources are consistent with commit verification and local test evidence; the free-text hook parses tool input.
Evidence against
- The setup wizard is explicitly user-invoked, and its autonomy mode is disclosed in its output.
- The inspected source does not establish that npm installation changes a consumer’s agent configuration or dependency script approvals.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
18 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/fix-better-sqlite3.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/threadline/PipeSessionSpawner.jsView file
15*/
L16: import { execSync } from 'node:child_process';
L17: import fs from 'node:fs';
High
Child Process
Package source references child process execution.
dist/threadline/PipeSessionSpawner.jsView on unpkg · L15352// Spawn tmux session, recording its incarnation (session id + pane pid)
L353: const created = execSync(`tmux new-session -d -P -F '#{session_id} #{pane_pid}' -s "${sessionName}" -x 200 -y 50 'bash -c "${shellCmd.replace(/"/g, '\\"')}"'`, { timeout: 10_000, e...
L354: const [tmuxId, panePid] = created.split(' ');
High
Shell
Package source references shell execution.
Findings
4 Critical11 High6 Medium5 Low
CriticalPersistence Backdoordist/core/GitSync.js
CriticalTrigger Reachable Dangerous Capabilitydist/core/GitSync.js
CriticalTrigger Reachable Excluded Directory Payloaddist/core/PostUpdateMigrator.js
CriticalPrevious Version Dangerous Deltadist/commands/server.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/threadline/PipeSessionSpawner.js
HighShelldist/threadline/PipeSessionSpawner.js
HighSame File Env Network Executionskills/spec-converge/scripts/publish-spec-review.mjs
HighCredential Redirect Persistencedist/messaging/TelegramAdapter.js
HighSandbox Evasion Gated Capabilitydist/commands/setup.js
Affected versions and remediation
This report applies to instar@1.3.1338.
See all versions of instar for other recorded verdicts.
- Review the evidence and your use of instar@1.3.1338 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.