instar@1.3.1389
⚠ Under reviewCoherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.
AI Security Review
scanned 3d ago · by lpm-firewall-aiInspected source shows a local native-module repair, Git signing support, and Playwright setup behavior, without confirming an attack. The required clean citation set exceeds the 256-citation output limit, so this review cannot be certified clean.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Package installation runs the postinstall hook; the Playwright setup is reached through the setup command.
Impact
No malicious effect is established by the inspected excerpts.
Mechanism
The postinstall script tests the local SQLite module, while setup registers Playwright MCP and installs browser binaries.
AI rationale
Inspected source shows a local native-module repair, Git signing support, and Playwright setup behavior, without confirming an attack. The required clean citation set exceeds the 256-citation output limit, so this review cannot be certified clean.
Decision evidence
public snapshotAI called this Manual Review at 52.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json defines a postinstall hook that runs a local SQLite repair script.
- The setup command registers a Playwright MCP server and installs its browser binaries.
- GitSync uses a machine signing key for Git commit signing.
- The inspected hook source describes a guard against collecting free-text credentials.
Evidence against
- The inspected postinstall repair exercises better-sqlite3 locally; no network transfer is shown in that excerpt.
- The reviewed source excerpts do not establish a confirmed attack.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
18 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/fix-better-sqlite3.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/threadline/PipeSessionSpawner.jsView file
15*/
L16: import { execSync } from 'node:child_process';
L17: import fs from 'node:fs';
High
Child Process
Package source references child process execution.
dist/threadline/PipeSessionSpawner.jsView on unpkg · L15352// Spawn tmux session, recording its incarnation (session id + pane pid)
L353: const created = execSync(`tmux new-session -d -P -F '#{session_id} #{pane_pid}' -s "${sessionName}" -x 200 -y 50 'bash -c "${shellCmd.replace(/"/g, '\\"')}"'`, { timeout: 10_000, e...
L354: const [tmuxId, panePid] = created.split(' ');
High
Shell
Package source references shell execution.
Findings
4 Critical11 High6 Medium5 Low
CriticalPersistence Backdoordist/core/GitSync.js
CriticalTrigger Reachable Dangerous Capabilitydist/core/GitSync.js
CriticalTrigger Reachable Excluded Directory Payloaddist/core/PostUpdateMigrator.js
CriticalPrevious Version Dangerous Deltadist/commands/init.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/threadline/PipeSessionSpawner.js
HighShelldist/threadline/PipeSessionSpawner.js
HighSame File Env Network Executionskills/spec-converge/scripts/publish-spec-review.mjs
HighCredential Redirect Persistencedist/messaging/TelegramAdapter.js
HighSandbox Evasion Gated Capabilitydist/commands/setup.js
Affected versions and remediation
This report applies to instar@1.3.1389.
See all versions of instar for other recorded verdicts.
- Review the evidence and your use of instar@1.3.1389 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.