instar@1.3.1342
Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe inspected agent configuration changes are tied to first-party setup and migration behavior, and the postinstall script repairs a native dependency. No concrete malicious behavior or unconsented foreign control-surface mutation was established, so this merits a warning for agent integration lifecycle risk rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running an initialization or migration command, or invoking the package’s post-update migration flow.
Impact
These actions change agent configuration and can affect later agent sessions, but the inspected behavior is package-owned setup and does not confirm malicious control or data exposure.
Mechanism
The commands create Claude settings or write an Instar session hook; the update migrator writes an Instar hook script.
AI rationale
The inspected agent configuration changes are tied to first-party setup and migration behavior, and the postinstall script repairs a native dependency. No concrete malicious behavior or unconsented foreign control-surface mutation was established, so this merits a warning for agent integration lifecycle risk rather than a block.
Evidence
.claude/settings.json.claude/hooks/instar/session-start.sh
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The postinstall hook runs a native dependency repair script; the manifest shows no automatic hook that invokes the agent configuration migrator.
- The post-update migrator writes an Instar-owned hook into the agent's hook directory.
- The init command scaffolds Claude settings only when Claude Code is enabled.
- The migration command writes a session hook under the project’s Instar hook directory.
- Other inspected agent integration locations load package-owned skills or session helpers, or manage memory under the agent’s own configuration home.
Evidence against
- The flagged source behavior is tied to package-owned agent setup and an update migration, rather than an observed unconsented install-time change to a foreign agent configuration.
- No inspected excerpt establishes credential theft, destructive behavior, stealth persistence, or remote payload execution.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
18 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/fix-better-sqlite3.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/threadline/PipeSessionSpawner.jsView file
15*/
L16: import { execSync } from 'node:child_process';
L17: import fs from 'node:fs';
High
Child Process
Package source references child process execution.
dist/threadline/PipeSessionSpawner.jsView on unpkg · L15352// Spawn tmux session, recording its incarnation (session id + pane pid)
L353: const created = execSync(`tmux new-session -d -P -F '#{session_id} #{pane_pid}' -s "${sessionName}" -x 200 -y 50 'bash -c "${shellCmd.replace(/"/g, '\\"')}"'`, { timeout: 10_000, e...
L354: const [tmuxId, panePid] = created.split(' ');
High
Shell
Package source references shell execution.
Findings
4 Critical11 High6 Medium5 Low
CriticalPersistence Backdoordist/core/GitSync.js
CriticalTrigger Reachable Dangerous Capabilitydist/core/GitSync.js
CriticalTrigger Reachable Excluded Directory Payloaddist/core/PostUpdateMigrator.js
CriticalPrevious Version Dangerous Deltadist/core/PostUpdateMigrator.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/threadline/PipeSessionSpawner.js
HighShelldist/threadline/PipeSessionSpawner.js
HighSame File Env Network Executionskills/spec-converge/scripts/publish-spec-review.mjs
HighCredential Redirect Persistencedist/messaging/TelegramAdapter.js
HighSandbox Evasion Gated Capabilitydist/commands/setup.js
Affected versions and remediation
This report applies to instar@1.3.1342.
See all versions of instar for other recorded verdicts.
- Review the evidence and your use of instar@1.3.1342 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.