instar@1.3.1423
⚠ Under reviewCoherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.
AI Security Review
scanned 4h ago · by lpm-firewall-aiThe inspected postinstall routine targets native dependency compatibility, and sampled credential excerpts show keychain access without establishing credential transfer. The required clean citation coverage exceeds the output limit, so the broader runtime review remains unresolved.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Installing the package invokes its postinstall hook.
Impact
No malicious effect was identified in this lifecycle path; the broader package behavior remains unresolved.
Mechanism
The hook checks better-sqlite3 and can rebuild that dependency for the current Node version.
AI rationale
The inspected postinstall routine targets native dependency compatibility, and sampled credential excerpts show keychain access without establishing credential transfer. The required clean citation coverage exceeds the output limit, so the broader runtime review remains unresolved.
Evidence
package.jsonscripts/fix-better-sqlite3.cjsdist/core/OAuthRefresher.jsdist/monitoring/CredentialProvider.jsdist/commands/setup.js
Decision evidence
public snapshotAI called this Manual Review at 58.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json maps the postinstall hook to scripts/fix-better-sqlite3.cjs.
- The hook skips when better-sqlite3 is absent and checks its native binary before rebuilding.
- If needed, the script runs npm rebuild for better-sqlite3 from the local dependency context.
- OAuthRefresher reads credentials from the operating system keychain; the inspected excerpt does not show a network send.
- CredentialProvider reads existing data from a named keychain service.
- Setup code writes MCP configuration and proceeds to register a Codex MCP section.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
29 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/fix-better-sqlite3.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/threadline/PipeSessionSpawner.jsView file
15*/
L16: import { execSync } from 'node:child_process';
L17: import fs from 'node:fs';
High
Child Process
Package source references child process execution.
dist/threadline/PipeSessionSpawner.jsView on unpkg · L15352// Spawn tmux session, recording its incarnation (session id + pane pid)
L353: const created = execSync(`tmux new-session -d -P -F '#{session_id} #{pane_pid}' -s "${sessionName}" -x 200 -y 50 'bash -c "${shellCmd.replace(/"/g, '\\"')}"'`, { timeout: 10_000, e...
L354: const [tmuxId, panePid] = created.split(' ');
High
Shell
Package source references shell execution.
Findings
3 Critical23 High6 Medium5 Low
CriticalPersistence Backdoordist/core/GitSync.js
CriticalTrigger Reachable Dangerous Capabilitydist/core/GitSync.js
CriticalTrigger Reachable Excluded Directory Payloaddist/core/PostUpdateMigrator.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/threadline/PipeSessionSpawner.js
HighShelldist/threadline/PipeSessionSpawner.js
HighSame File Env Network Executionskills/spec-converge/scripts/publish-spec-review.mjs
HighCredential Redirect Persistencedist/messaging/TelegramAdapter.js
HighSandbox Evasion Gated Capabilitydist/commands/setup.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/core/PostUpdateMigrator.js
Affected versions and remediation
This report applies to instar@1.3.1423.
See all versions of instar for other recorded verdicts.
- Review the evidence and your use of instar@1.3.1423 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.