instar@1.3.1400
Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe install hook is a native dependency repair, but runtime migration automatically registers and arms project-scoped Codex hooks without a separate affirmative setup step. The code limits the registration to Instar-owned project hooks, so the supported finding is an agent-extension lifecycle warning rather than a confirmed attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The server starts after an installed-version change, and the project has Codex enabled; arming is on by default unless the saved opt-out is set.
Impact
Project Codex sessions gain automatically activated hooks without a separate affirmative setup step; the behavior presents residual agent-extension lifecycle risk.
Mechanism
Migration writes Instar hook registrations to the project’s .codex/hooks.json and uses Codex’s trust flow to arm them. The hooks can then run during that project’s Codex events.
AI rationale
The install hook is a native dependency repair, but runtime migration automatically registers and arms project-scoped Codex hooks without a separate affirmative setup step. The code limits the registration to Instar-owned project hooks, so the supported finding is an agent-extension lifecycle warning rather than a confirmed attack.
Evidence
package.jsondist/commands/server.jsdist/core/PostUpdateMigrator.jsdist/core/installCodexHooks.jsdist/core/codexHookArm.js<projectDir>/.codex/hooks.json<projectDir>/.instar/hooks/instar/
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package postinstall runs a script that repairs better-sqlite3's native binary; it does not invoke the migration path.
- On server startup after a version change, migration registers Codex hooks when Codex is enabled and arms them by default; users can opt out with a saved setting.
- The hook registration writes to the project’s .codex/hooks.json and preserves user-added hooks. The arming code checks that registered hooks belong to Instar.
- Other inspected agent integration locations concern explicit project setup or migration, skill lookup, project scanning, and capability discovery.
- The inspected credential locations read and write local OS keychain entries; no credential transfer to a remote recipient was established. The quota location reports session enforcement events.
Evidence against
- The postinstall script is limited to native dependency repair.
- The Codex hook registration is project-scoped and replaces only Instar-owned entries; the risk identified is automatic setup and activation, not demonstrated malicious hook behavior.
Behavioral surface
Source & flagged code
18 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/fix-better-sqlite3.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/threadline/PipeSessionSpawner.jsView file
15*/
L16: import { execSync } from 'node:child_process';
L17: import fs from 'node:fs';
High
Child Process
Package source references child process execution.
dist/threadline/PipeSessionSpawner.jsView on unpkg · L15352// Spawn tmux session, recording its incarnation (session id + pane pid)
L353: const created = execSync(`tmux new-session -d -P -F '#{session_id} #{pane_pid}' -s "${sessionName}" -x 200 -y 50 'bash -c "${shellCmd.replace(/"/g, '\\"')}"'`, { timeout: 10_000, e...
L354: const [tmuxId, panePid] = created.split(' ');
High
Shell
Package source references shell execution.
Findings
4 Critical11 High6 Medium5 Low
CriticalPersistence Backdoordist/core/GitSync.js
CriticalTrigger Reachable Dangerous Capabilitydist/core/GitSync.js
CriticalTrigger Reachable Excluded Directory Payloaddist/core/PostUpdateMigrator.js
CriticalPrevious Version Dangerous Deltadist/commands/init.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/threadline/PipeSessionSpawner.js
HighShelldist/threadline/PipeSessionSpawner.js
HighSame File Env Network Executionskills/spec-converge/scripts/publish-spec-review.mjs
HighCredential Redirect Persistencedist/messaging/TelegramAdapter.js
HighSandbox Evasion Gated Capabilitydist/commands/setup.js
Affected versions and remediation
This report applies to instar@1.3.1400.
See all versions of instar for other recorded verdicts.
- Review the evidence and your use of instar@1.3.1400 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.