registry / @ainyc/canonry / 4.102.1

@ainyc/canonry@4.102.1

Agent-first open-source AEO operating platform - track how answer engines cite your domain

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 4.34 MB of source, external domains: accounts.google.com, aistudio.google.com, analyticsdata.googleapis.com, api.ads.openai.com, api.deepinfra.com, api.perplexity.ai, bit.ly, brightkidsdental.com, businessprofileperformance.googleapis.com, canonry.ai, canonry.local, citypointdental.com, commoncrawl.org, console.cloud.google.com, console.developers.google.com, data.commoncrawl.org, developers.google.com, downtownsmiles.com, example.com, github.com, harbordental.com, hooks.example.com, indexing.googleapis.com, json-schema.org, logging.googleapis.com, mybusinessaccountmanagement.googleapis.com, mybusinessbusinessinformation.googleapis.com, mybusinesslodging.googleapis.com, oauth2.googleapis.com, openai.com, parkpediatricdental.com, places.googleapis.com, platform.claude.com, platform.openai.com, radix-ui.com, rdap.arin.net, react.dev, redacted.invalid, redux-toolkit.js.org, redux.js.org, registry.npmjs.org, schema.org, searchconsole.googleapis.com, ssl.bing.com, support.google.com, vercel.com, www.bing.com, www.googleapis.com, www.npmjs.com, www.perplexity.ai

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 4850-4890javascript

4850 publicUrl: opts.publicUrl

4851 });

4852 if (isMachineFormat(opts.format)) {

4853 console.log(JSON.stringify({

4854 project,

4855 type: opts.type,

4856 authUrl,

4857 redirectUri: redirectUri ?? null

4858 }, null, 2));

4859 return;

4860 }

4861 console.log(`

4862Open this URL in your browser to authorize Google ${opts.type.toUpperCase()} access:

4863`);

4864 console.log(` ${authUrl}

4865`);

4866 if (redirectUri) {

4867 console.log(`Redirect URI: ${redirectUri}`);

4868 console.log("(Ensure this URI is listed in your Google Cloud Console OAuth client's authorized redirect URIs)\n");

4869 }

4870 try {

4871 const { spawn: spawn2 } = await import("child_process");

4872 const platform = process.platform;

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L4870

4873 const [cmd, ...extraArgs] = platform === "darwin" ? ["open", authUrl] : platform === "win32" ? ["cmd", "/c", "start", "", authUrl] : ["xdg-open", authUrl];

4874 spawn2(cmd, [...extraArgs], { detached: true, stdio: "ignore" }).unref();

4875 console.log("(Browser opened automatically)");

4876 } catch {

4877 console.log("(Could not open browser automatically \u2014 please copy the URL above)");

4878 }

4879}

4880async function googleDisconnect(project, opts) {

4881 const client = getClient10();

4882 await client.googleDisconnect(project, opts.type);

4883 if (isMachineFormat(opts.format)) {

4884 console.log(JSON.stringify({ project, type: opts.type, disconnected: true }, null, 2));

4885 return;

4886 }

4887 console.log(`Disconnected Google ${opts.type.toUpperCase()} from project "${project}".`);

4888}

4889async function googleStatus(project, format) {

4890 const client = getClient10();

Lines 10310-10350javascript

10310 tx.insert(apiKeys).values({

10311 id: crypto.randomUUID(),

10312 name: "default",

10313 keyHash,

10314 keyPrefix,

10315 scopes: ["*"],

10316 createdAt: (/* @__PURE__ */ new Date()).toISOString()

10317 }).run();

dist/chunk-3PVCILSN.jsView file

Lines 165-205javascript

165 isBrowserProvider,

166 isGhostTelemetryEvent,

167 isRetryableHttpError,

168 normalizeUrlPath,

169 notFound,

170 parseOriginList,

171 providerError,

172 resolveSnapshotRequestQueries,

173 serializeRunError,

174 skillsClientSchema,

175 splitList,

176 validationError,

177

Source & flagged code

3 flagged · loading source

dist/cli.jsView file

4870try { L4871: const { spawn: spawn2 } = await import("child_process"); L4872: const platform = process.platform;

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L4870

10330databasePath, L10331: apiUrl: env.apiUrl || existingConfig?.apiUrl || `http://localhost:${process.env.CANONRY_PORT || "4100"}`, L10332: providers: Object.keys(mergedProviders ?? {}), ... L10345: // src/commands/daemon.ts L10346: import { spawn } from "child_process"; L10347: import fs9 from "fs";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L10330

dist/chunk-3PVCILSN.jsView file

185var _require = createRequire(import.meta.url); L186: var { version: VERSION } = _require("../package.json"); L187: var TELEMETRY_ENDPOINT = "https://canonry.ai/api/telemetry"; L188: var TIMEOUT_MS = 3e3; ... L199: function isTelemetryEnabled() { L200: if (process.env.CANONRY_TELEMETRY_DISABLED === "1") return false; L201: if (process.env.DO_NOT_TRACK === "1") return false; L202: if (process.env.CI) return false; L203: if (!configExists()) return true; ... L241: try { L242: const hostname = os.hostname() || ""; L243: const mac = firstNonInternalMac();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/chunk-3PVCILSN.jsView on unpkg · L185

Findings

4 High4 Medium6 Low

HighChild Processdist/cli.js

HighShell

HighSame File Env Network Executiondist/cli.js

HighHost Fingerprint Exfiltrationdist/chunk-3PVCILSN.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 4850-4890javascript

4850 publicUrl: opts.publicUrl

4851 });

4852 if (isMachineFormat(opts.format)) {

4853 console.log(JSON.stringify({

4854 project,

4855 type: opts.type,

4856 authUrl,

4857 redirectUri: redirectUri ?? null

4858 }, null, 2));

4859 return;

4860 }

4861 console.log(`

4862Open this URL in your browser to authorize Google ${opts.type.toUpperCase()} access:

4863`);

4864 console.log(` ${authUrl}

4865`);

4866 if (redirectUri) {

4867 console.log(`Redirect URI: ${redirectUri}`);

4868 console.log("(Ensure this URI is listed in your Google Cloud Console OAuth client's authorized redirect URIs)\n");

4869 }

4870 try {

4871 const { spawn: spawn2 } = await import("child_process");

4872 const platform = process.platform;

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L4870

4873 const [cmd, ...extraArgs] = platform === "darwin" ? ["open", authUrl] : platform === "win32" ? ["cmd", "/c", "start", "", authUrl] : ["xdg-open", authUrl];

4874 spawn2(cmd, [...extraArgs], { detached: true, stdio: "ignore" }).unref();

4875 console.log("(Browser opened automatically)");

4876 } catch {

4877 console.log("(Could not open browser automatically \u2014 please copy the URL above)");

4878 }

4879}

4880async function googleDisconnect(project, opts) {

4881 const client = getClient10();

4882 await client.googleDisconnect(project, opts.type);

4883 if (isMachineFormat(opts.format)) {

4884 console.log(JSON.stringify({ project, type: opts.type, disconnected: true }, null, 2));

4885 return;

4886 }

4887 console.log(`Disconnected Google ${opts.type.toUpperCase()} from project "${project}".`);

4888}

4889async function googleStatus(project, format) {

4890 const client = getClient10();

Lines 10310-10350javascript

10310 tx.insert(apiKeys).values({

10311 id: crypto.randomUUID(),

10312 name: "default",

10313 keyHash,

10314 keyPrefix,

10315 scopes: ["*"],

10316 createdAt: (/* @__PURE__ */ new Date()).toISOString()

10317 }).run();

dist/chunk-3PVCILSN.jsView file

Lines 165-205javascript

165 isBrowserProvider,

166 isGhostTelemetryEvent,

167 isRetryableHttpError,

168 normalizeUrlPath,

169 notFound,

170 parseOriginList,

171 providerError,

172 resolveSnapshotRequestQueries,

173 serializeRunError,

174 skillsClientSchema,

175 splitList,

176 validationError,

177