instar@1.3.1405
Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.
AI Security Review
scanned 2d ago · by lpm-firewall-aiSource inspection confirms that successful updates can trigger first-party hook installation and default-on Codex auto-arming, which can activate package-owned hooks without the usual human trust action. This is a guarded extension lifecycle risk; the inspected source does not support a publish block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A successful Instar update with migration configured.
Impact
Package-owned hooks may become active without the usual human trust action. No external recipient or credential transfer was established in the inspected paths.
Mechanism
The new CLI runs the migration flow, which writes hook files and agent settings; Codex hooks are armed by default through a tmux trust driver when Codex is detected, unless configuration disables auto-arming.
AI rationale
Source inspection confirms that successful updates can trigger first-party hook installation and default-on Codex auto-arming, which can activate package-owned hooks without the usual human trust action. This is a guarded extension lifecycle risk; the inspected source does not support a publish block.
Evidence
dist/core/PostUpdateMigrator.jsdist/core/UpdateChecker.jsdist/core/installCodexHooks.js
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest declares a postinstall command that runs a SQLite repair script.
- After a successful update, the updater invokes the new CLI's migration command.
- The migration flow installs Instar-owned hooks and updates agent settings.
- Codex hook auto-arming defaults to on and uses a tmux trust driver when Codex is detected; a configuration setting can disable it. The source says the hooks otherwise await a human trust action.
- The inspected setup locations cover project documentation, a command-driven hook update, Playwright MCP setup, worktree metadata, relay script writing, and Codex hook configuration.
- The cited credential excerpts show local OS keychain reads and writes; they do not establish an external recipient.
Evidence against
- The inspected postinstall declaration does not invoke the post-update migrator.
- The reviewed credential and quota excerpts do not establish credential exfiltration or an unrelated account action.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
18 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/fix-better-sqlite3.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/threadline/PipeSessionSpawner.jsView file
15*/
L16: import { execSync } from 'node:child_process';
L17: import fs from 'node:fs';
High
Child Process
Package source references child process execution.
dist/threadline/PipeSessionSpawner.jsView on unpkg · L15352// Spawn tmux session, recording its incarnation (session id + pane pid)
L353: const created = execSync(`tmux new-session -d -P -F '#{session_id} #{pane_pid}' -s "${sessionName}" -x 200 -y 50 'bash -c "${shellCmd.replace(/"/g, '\\"')}"'`, { timeout: 10_000, e...
L354: const [tmuxId, panePid] = created.split(' ');
High
Shell
Package source references shell execution.
Findings
4 Critical11 High6 Medium5 Low
CriticalPersistence Backdoordist/core/GitSync.js
CriticalTrigger Reachable Dangerous Capabilitydist/core/GitSync.js
CriticalTrigger Reachable Excluded Directory Payloaddist/core/PostUpdateMigrator.js
CriticalPrevious Version Dangerous Deltadist/core/PostUpdateMigrator.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/threadline/PipeSessionSpawner.js
HighShelldist/threadline/PipeSessionSpawner.js
HighSame File Env Network Executionskills/spec-converge/scripts/publish-spec-review.mjs
HighCredential Redirect Persistencedist/messaging/TelegramAdapter.js
HighSandbox Evasion Gated Capabilitydist/commands/setup.js
Affected versions and remediation
This report applies to instar@1.3.1405.
See all versions of instar for other recorded verdicts.
- Review the evidence and your use of instar@1.3.1405 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.