instar@1.3.1388
⚠ Under reviewCoherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe inspected source does not independently support a warning or block. A clean verdict requires source citation coverage beyond the output limit, so the remaining package behavior needs review.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
No attack trigger was confirmed in the inspected source.
Impact
No attack impact was established from the inspected source.
Mechanism
The inspected postinstall script is a native database compatibility repair, and the inspected migrator excerpt installs a package-owned agent hook.
AI rationale
The inspected source does not independently support a warning or block. A clean verdict requires source citation coverage beyond the output limit, so the remaining package behavior needs review.
Decision evidence
public snapshotAI called this Manual Review at 48.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest’s postinstall hook invokes a native database compatibility script, whose source describes checking the installed binary.
- The update migrator installs package-owned agent hooks as part of runtime migration; the available excerpts do not establish a concrete attack.
- The reviewed GitSync excerpt derives a public key from the package’s machine signing key.
Evidence against
- The inspected excerpts do not establish credential theft, destructive behavior, or an install-time agent configuration attack.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
18 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/fix-better-sqlite3.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/threadline/PipeSessionSpawner.jsView file
15*/
L16: import { execSync } from 'node:child_process';
L17: import fs from 'node:fs';
High
Child Process
Package source references child process execution.
dist/threadline/PipeSessionSpawner.jsView on unpkg · L15352// Spawn tmux session, recording its incarnation (session id + pane pid)
L353: const created = execSync(`tmux new-session -d -P -F '#{session_id} #{pane_pid}' -s "${sessionName}" -x 200 -y 50 'bash -c "${shellCmd.replace(/"/g, '\\"')}"'`, { timeout: 10_000, e...
L354: const [tmuxId, panePid] = created.split(' ');
High
Shell
Package source references shell execution.
Findings
4 Critical11 High6 Medium5 Low
CriticalPersistence Backdoordist/core/GitSync.js
CriticalTrigger Reachable Dangerous Capabilitydist/core/GitSync.js
CriticalTrigger Reachable Excluded Directory Payloaddist/core/PostUpdateMigrator.js
CriticalPrevious Version Dangerous Deltadist/commands/init.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/threadline/PipeSessionSpawner.js
HighShelldist/threadline/PipeSessionSpawner.js
HighSame File Env Network Executionskills/spec-converge/scripts/publish-spec-review.mjs
HighCredential Redirect Persistencedist/messaging/TelegramAdapter.js
HighSandbox Evasion Gated Capabilitydist/commands/setup.js
Affected versions and remediation
This report applies to instar@1.3.1388.
See all versions of instar for other recorded verdicts.
- Review the evidence and your use of instar@1.3.1388 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.