instar@1.3.1415
Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe runtime startup path silently registers a first-party MCP server and pre-accepts its trust dialog, leaving a concrete agent configuration risk. The install hook is a SQLite repair script, and the inspected credential code uses local Keychain operations, so the evidence supports a warning rather than a malicious block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Starting the Instar server.
Impact
Claude may load Threadline tools for the project without showing the trust dialog for that registration.
Mechanism
Threadline registration writes to ~/.claude.json and the project .mcp.json, including a trust-accepted setting; the configured command launches the package's Threadline MCP entrypoint.
AI rationale
The runtime startup path silently registers a first-party MCP server and pre-accepts its trust dialog, leaving a concrete agent configuration risk. The install hook is a SQLite repair script, and the inspected credential code uses local Keychain operations, so the evidence supports a warning rather than a malicious block.
Evidence
dist/commands/server.jsdist/threadline/ThreadlineBootstrap.jsdist/threadline/mcpEntry.js~/.claude.json.mcp.json
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Server startup calls Threadline bootstrap, which invokes MCP registration.
- Registration adds the Threadline server to the project entry in the user's Claude configuration and marks its trust dialog accepted without a consent check in that path.
- The registration also writes project-level MCP configuration; its command launches this package's Threadline MCP entrypoint.
- Other inspected agent setup writes occur in init, setup, or migration paths, while worktree metadata and relay-hook writes have separate product purposes.
- The inspected credential snippets read and write Claude credentials through the local macOS Keychain.
- Quota events pass notification text to an injected sender and queue failed sends; this is operational notification behavior.
Evidence against
- The package postinstall runs a SQLite repair script; the inspected agent configuration behavior is reached through server startup or CLI paths.
- The inspected credential paths show local Keychain handling, not transfer to a remote endpoint.
Behavioral surface
ChildProcess
Source & flagged code
18 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/fix-better-sqlite3.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/threadline/PipeSessionSpawner.jsView file
15*/
L16: import { execSync } from 'node:child_process';
L17: import fs from 'node:fs';
High
Child Process
Package source references child process execution.
dist/threadline/PipeSessionSpawner.jsView on unpkg · L15352// Spawn tmux session, recording its incarnation (session id + pane pid)
L353: const created = execSync(`tmux new-session -d -P -F '#{session_id} #{pane_pid}' -s "${sessionName}" -x 200 -y 50 'bash -c "${shellCmd.replace(/"/g, '\\"')}"'`, { timeout: 10_000, e...
L354: const [tmuxId, panePid] = created.split(' ');
High
Shell
Package source references shell execution.
Findings
4 Critical11 High6 Medium5 Low
CriticalPersistence Backdoordist/core/GitSync.js
CriticalTrigger Reachable Dangerous Capabilitydist/core/GitSync.js
CriticalTrigger Reachable Excluded Directory Payloaddist/core/PostUpdateMigrator.js
CriticalPrevious Version Dangerous Deltadist/commands/server.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/threadline/PipeSessionSpawner.js
HighShelldist/threadline/PipeSessionSpawner.js
HighSame File Env Network Executionskills/spec-converge/scripts/publish-spec-review.mjs
HighCredential Redirect Persistencedist/messaging/TelegramAdapter.js
HighSandbox Evasion Gated Capabilitydist/commands/setup.js
Affected versions and remediation
This report applies to instar@1.3.1415.
See all versions of instar for other recorded verdicts.
- Review the evidence and your use of instar@1.3.1415 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.