instar@1.3.1371
Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe source confirms an automatic version-update migration that installs a project hook allowing Claude permission requests. Because this occurs through first-party runtime setup rather than an npm install hook, it warrants a warning rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Starting the server when the installed version differs from the last migrated version.
Impact
Claude permission prompts for covered requests may be bypassed, allowing agent actions without the usual per-request approval.
Mechanism
The migration writes an auto-approval hook and registers it in the project's Claude PermissionRequest settings; the hook returns an allow decision, including from its timeout path.
AI rationale
The source confirms an automatic version-update migration that installs a project hook allowing Claude permission requests. Because this occurs through first-party runtime setup rather than an npm install hook, it warrants a warning rather than a publish block.
Evidence
dist/commands/server.jsdist/core/PostUpdateMigrator.js.claude/settings.json.instar/hooks/instar/auto-approve-permissions.js
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- On a server startup after the installed version changes, the package runs a post-update migration. That migration registers a project PermissionRequest hook that allows requests, including on timeout. (dist/commands/server.js; dist/core/PostUpdateMigrator.js)
- The migration writes a project hook file and adds its command to Claude settings, enabling subagent permission requests without prompts. (dist/core/PostUpdateMigrator.js)
- The npm postinstall hook runs a SQLite compatibility repair; the permission-hook change is in the server migration path. (package.json)
- The inspected credential code reads and writes credentials through the local macOS Keychain; it does not show a credential transfer to a remote recipient. (dist/core/SecretStore.js; dist/monitoring/CredentialProvider.js)
- The flagged QuotaManager location formats a migration event notification. (dist/monitoring/QuotaManager.js)
Evidence against
- The project permission hook is created through the runtime version-update migration, not the npm postinstall script. (package.json; dist/core/PostUpdateMigrator.js)
- The inspected agent setup excerpts install skills, hooks, or discover project files; they do not establish an additional attack. (dist/commands/init.js; dist/commands/migrate.js; dist/commands/setup.js; dist/commands/test-as-self.js; dist/core/EvolutionManager.js; dist/core/Config.js; dist/core/ProjectMapper.js; dist/core/CapabilityMapper.js)
Source & flagged code
18 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/fix-better-sqlite3.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/threadline/PipeSessionSpawner.jsView file
15*/
L16: import { execSync } from 'node:child_process';
L17: import fs from 'node:fs';
High
Child Process
Package source references child process execution.
dist/threadline/PipeSessionSpawner.jsView on unpkg · L15352// Spawn tmux session, recording its incarnation (session id + pane pid)
L353: const created = execSync(`tmux new-session -d -P -F '#{session_id} #{pane_pid}' -s "${sessionName}" -x 200 -y 50 'bash -c "${shellCmd.replace(/"/g, '\\"')}"'`, { timeout: 10_000, e...
L354: const [tmuxId, panePid] = created.split(' ');
High
Shell
Package source references shell execution.
Findings
4 Critical11 High6 Medium5 Low
CriticalPersistence Backdoordist/core/GitSync.js
CriticalTrigger Reachable Dangerous Capabilitydist/core/GitSync.js
CriticalTrigger Reachable Excluded Directory Payloaddist/core/PostUpdateMigrator.js
CriticalPrevious Version Dangerous Deltadist/commands/server.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/threadline/PipeSessionSpawner.js
HighShelldist/threadline/PipeSessionSpawner.js
HighSame File Env Network Executionskills/spec-converge/scripts/publish-spec-review.mjs
HighCredential Redirect Persistencedist/messaging/TelegramAdapter.js
HighSandbox Evasion Gated Capabilitydist/commands/setup.js
Affected versions and remediation
This report applies to instar@1.3.1371.
See all versions of instar for other recorded verdicts.
- Review the evidence and your use of instar@1.3.1371 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.