instar@1.3.1349
Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe version-gated migration installs and registers a hook that automatically allows PermissionRequest events, creating a real agent permission risk. This supports a warning for first-party agent extension setup, but not a malicious block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Starting the server after the installed package version differs from the last migrated version.
Impact
Subagent actions may proceed without the corresponding interactive permission prompt.
Mechanism
The migration installs the hook and adds a catch-all PermissionRequest command to Claude settings; the hook returns an allow decision.
AI rationale
The version-gated migration installs and registers a hook that automatically allows PermissionRequest events, creating a real agent permission risk. This supports a warning for first-party agent extension setup, but not a malicious block.
Evidence
dist/commands/server.jsdist/core/PostUpdateMigrator.js.claude/settings.json.instar/hooks/instar/auto-approve-permissions.js
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package’s postinstall runs a SQLite repair script; the agent permission change occurs in a separate server-start migration.
- On startup, a version change triggers the post-update migration.
- The migration adds a PermissionRequest handler to the Claude settings hooks.
- That handler returns an allow decision for all PermissionRequest events.
- The migration writes the updated settings file, and the package-owned hook is installed under the project’s Instar hooks directory.
Evidence against
- The permission change is first-party setup performed by a version-gated migration, not an npm install hook that mutates a foreign agent configuration.
- The package describes the hook as a way to unblock subagent tool use; the source does not show credential collection, exfiltration, or remote payload execution.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
18 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/fix-better-sqlite3.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/threadline/PipeSessionSpawner.jsView file
15*/
L16: import { execSync } from 'node:child_process';
L17: import fs from 'node:fs';
High
Child Process
Package source references child process execution.
dist/threadline/PipeSessionSpawner.jsView on unpkg · L15352// Spawn tmux session, recording its incarnation (session id + pane pid)
L353: const created = execSync(`tmux new-session -d -P -F '#{session_id} #{pane_pid}' -s "${sessionName}" -x 200 -y 50 'bash -c "${shellCmd.replace(/"/g, '\\"')}"'`, { timeout: 10_000, e...
L354: const [tmuxId, panePid] = created.split(' ');
High
Shell
Package source references shell execution.
Findings
4 Critical11 High6 Medium5 Low
CriticalPersistence Backdoordist/core/GitSync.js
CriticalTrigger Reachable Dangerous Capabilitydist/core/GitSync.js
CriticalTrigger Reachable Excluded Directory Payloaddist/core/PostUpdateMigrator.js
CriticalPrevious Version Dangerous Deltadist/commands/server.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/threadline/PipeSessionSpawner.js
HighShelldist/threadline/PipeSessionSpawner.js
HighSame File Env Network Executionskills/spec-converge/scripts/publish-spec-review.mjs
HighCredential Redirect Persistencedist/messaging/TelegramAdapter.js
HighSandbox Evasion Gated Capabilitydist/commands/setup.js
Affected versions and remediation
This report applies to instar@1.3.1349.
See all versions of instar for other recorded verdicts.
- Review the evidence and your use of instar@1.3.1349 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.