instar@1.3.1421
⚠ Under reviewCoherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.
AI Security Review
scanned 7h ago · by lpm-firewall-aiInspected behavior was consistent with native-module repair, explicit setup, and intended Claude authentication; it did not establish an attack. The complete clean citation checklist exceeds the allowed citation count, so this review cannot certify the package clean.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Package installation or an explicit setup command.
Impact
No malicious effect was confirmed in the inspected paths; the package cannot be cleared without the full required source coverage.
Mechanism
The inspected install hook repairs a native dependency; the setup command writes agent configuration, and credential code uses local keychain storage and Claude's token endpoint.
AI rationale
Inspected behavior was consistent with native-module repair, explicit setup, and intended Claude authentication; it did not establish an attack. The complete clean citation checklist exceeds the allowed citation count, so this review cannot certify the package clean.
Evidence
package.jsonscripts/fix-better-sqlite3.cjsdist/cli.jsdist/commands/setup.js
Network endpoints1
platform.claude.com/v1/oauth/token
Decision evidence
public snapshotAI called this Manual Review at 66.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json runs a postinstall native-module repair script; the inspected script describes repairing better-sqlite3.
- The CLI exposes setup as an explicit command and invokes the setup wizard; inspected setup code writes agent configuration.
- The inspected credential code reads and updates local keychain entries, and OAuth refresh defaults to Claude's token endpoint.
- The inspected better-sqlite3 install hook runs prebuild-install or node-gyp to build its native module.
Evidence against
- The inspected source did not establish a concrete attack or an unrelated credential recipient.
- The full clean review requires more distinct source citations than the output limit permits.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsPossibleObfuscation
Source & flagged code
29 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/fix-better-sqlite3.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/threadline/PipeSessionSpawner.jsView file
15*/
L16: import { execSync } from 'node:child_process';
L17: import fs from 'node:fs';
High
Child Process
Package source references child process execution.
dist/threadline/PipeSessionSpawner.jsView on unpkg · L15352// Spawn tmux session, recording its incarnation (session id + pane pid)
L353: const created = execSync(`tmux new-session -d -P -F '#{session_id} #{pane_pid}' -s "${sessionName}" -x 200 -y 50 'bash -c "${shellCmd.replace(/"/g, '\\"')}"'`, { timeout: 10_000, e...
L354: const [tmuxId, panePid] = created.split(' ');
High
Shell
Package source references shell execution.
Findings
3 Critical23 High6 Medium5 Low
CriticalPersistence Backdoordist/core/GitSync.js
CriticalTrigger Reachable Dangerous Capabilitydist/core/GitSync.js
CriticalTrigger Reachable Excluded Directory Payloaddist/core/PostUpdateMigrator.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/threadline/PipeSessionSpawner.js
HighShelldist/threadline/PipeSessionSpawner.js
HighSame File Env Network Executionskills/spec-converge/scripts/publish-spec-review.mjs
HighCredential Redirect Persistencedist/messaging/TelegramAdapter.js
HighSandbox Evasion Gated Capabilitydist/commands/setup.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/core/PostUpdateMigrator.js
Affected versions and remediation
This report applies to instar@1.3.1421.
See all versions of instar for other recorded verdicts.
- Review the evidence and your use of instar@1.3.1421 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.