registry / @canonry/canonry / 4.109.0

@canonry/canonry@4.109.0

Agent-first open-source AEO operating platform - track how answer engines cite your domain

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package has opt-out product telemetry and user-invoked local config/agent-skill installation for its Canonry CLI/MCP workflow.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs canonry/cnry CLI commands such as init, serve, mcp install, or skills install.

Impact

CLI may send anonymized command telemetry and update local Canonry/MCP/skill configuration when requested.

Mechanism

Product telemetry plus explicit CLI-managed config writes

Rationale

Static inspection found no install-time execution, hidden credential harvesting, destructive behavior, persistence, or unconsented AI-agent control-surface mutation. The risky primitives are tied to documented Canonry CLI/MCP/agent features and explicit runtime commands, so scanner labels appear noisy.

Evidence

package.jsonbin/canonry.mjsbin/canonry-mcp.mjsdist/cli.jsdist/chunk-YEOLQT5S.jsdist/index.jsdist/mcp.jsREADME.mdassets/agent-workspace/AGENTS.mdassets/agent-workspace/skills/canonry/SKILL.mddist/chunk-3HKBUYIY.js

Network endpoints2

canonry.ai/api/telemetryregistry.npmjs.org/-/package/@canonry/canonry/dist-tags

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/chunk-YEOLQT5S.js derives an anonymous telemetry ID from hostname and first non-internal MAC, then posts CLI events to https://canonry.ai/api/telemetry.
dist/cli.js can write MCP/agent skill config under .mcp.json, .claude/skills, .codex/skills, or Claude/Cursor config, but only through user-invoked init/skills/mcp commands.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks.
bin/canonry.mjs and bin/canonry-mcp.mjs only import CLI/MCP main functions.
dist/cli.js only runs main when invoked as the entrypoint; import exposes runCli/main without immediate command execution.
Telemetry is package-aligned, disclosed in CLI first-run notice, disabled by CANONRY_TELEMETRY_DISABLED, DO_NOT_TRACK, CI, or config telemetry=false.
README.md documents cnry init installing agent skills and requiring sign-off before site-changing agent actions.
child_process usage is user-facing browser opening and daemon start, not hidden payload execution.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 4.37 MB of source, external domains: accounts.google.com, aistudio.google.com, analyticsdata.googleapis.com, api.ads.openai.com, api.deepinfra.com, api.perplexity.ai, bit.ly, brightkidsdental.com, businessprofileperformance.googleapis.com, canonry.ai, canonry.local, citypointdental.com, commoncrawl.org, console.cloud.google.com, console.developers.google.com, data.commoncrawl.org, developers.google.com, downtownsmiles.com, example.com, github.com, harbordental.com, hooks.example.com, indexing.googleapis.com, json-schema.org, logging.googleapis.com, mybusinessaccountmanagement.googleapis.com, mybusinessbusinessinformation.googleapis.com, mybusinesslodging.googleapis.com, oauth2.googleapis.com, openai.com, parkpediatricdental.com, places.googleapis.com, platform.claude.com, platform.openai.com, radix-ui.com, rdap.arin.net, react.dev, redacted.invalid, redux-toolkit.js.org, redux.js.org, registry.npmjs.org, schema.org, searchconsole.googleapis.com, ssl.bing.com, support.google.com, vercel.com, www.bing.com, www.googleapis.com, www.npmjs.com, www.perplexity.ai

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 4868-4908javascript

4868 publicUrl: opts.publicUrl

4869 });

4870 if (isMachineFormat(opts.format)) {

4871 console.log(JSON.stringify({

4872 project,

4873 type: opts.type,

4874 authUrl,

4875 redirectUri: redirectUri ?? null

4876 }, null, 2));

4877 return;

4878 }

4879 console.log(`

4880Open this URL in your browser to authorize Google ${opts.type.toUpperCase()} access:

4881`);

4882 console.log(` ${authUrl}

4883`);

4884 if (redirectUri) {

4885 console.log(`Redirect URI: ${redirectUri}`);

4886 console.log("(Ensure this URI is listed in your Google Cloud Console OAuth client's authorized redirect URIs)\n");

4887 }

4888 try {

4889 const { spawn: spawn2 } = await import("child_process");

4890 const platform = process.platform;

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L4888

4891 const [cmd, ...extraArgs] = platform === "darwin" ? ["open", authUrl] : platform === "win32" ? ["cmd", "/c", "start", "", authUrl] : ["xdg-open", authUrl];

4892 spawn2(cmd, [...extraArgs], { detached: true, stdio: "ignore" }).unref();

4893 console.log("(Browser opened automatically)");

4894 } catch {

4895 console.log("(Could not open browser automatically \u2014 please copy the URL above)");

4896 }

4897}

4898async function googleDisconnect(project, opts) {

4899 const client = getClient10();

4900 await client.googleDisconnect(project, opts.type);

4901 if (isMachineFormat(opts.format)) {

4902 console.log(JSON.stringify({ project, type: opts.type, disconnected: true }, null, 2));

4903 return;

4904 }

4905 console.log(`Disconnected Google ${opts.type.toUpperCase()} from project "${project}".`);

4906}

4907async function googleStatus(project, format) {

4908 const client = getClient10();

Lines 10328-10368javascript

10328 tx.insert(apiKeys).values({

10329 id: crypto.randomUUID(),

10330 name: "default",

10331 keyHash,

10332 keyPrefix,

10333 scopes: ["*"],

10334 createdAt: (/* @__PURE__ */ new Date()).toISOString()

10335 }).run();

dist/chunk-YEOLQT5S.jsView file

Lines 167-207javascript

167 isRetryableHttpError,

168 normalizeIdTokens,

169 normalizeUrlPath,

170 notFound,

171 parseOriginList,

172 providerError,

173 resolveSnapshotRequestQueries,

174 serializeForInlineScript,

175 serializeRunError,

176 skillsClientSchema,

177 splitList,

178 validationError,

179

dist/chunk-3HKBUYIY.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @canonry/canonry@4.108.0 matchedIdentity = npm:QGNhbm9ucnkvY2Fub25yeQ:4.108.0 similarity = 0.962 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-3HKBUYIY.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/cli.jsView file

4888try { L4889: const { spawn: spawn2 } = await import("child_process"); L4890: const platform = process.platform;

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L4888

10348databasePath, L10349: apiUrl: env.apiUrl || existingConfig?.apiUrl || `http://localhost:${process.env.CANONRY_PORT || "4100"}`, L10350: providers: Object.keys(mergedProviders ?? {}), ... L10363: // src/commands/daemon.ts L10364: import { spawn } from "child_process"; L10365: import fs9 from "fs";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L10348

dist/chunk-YEOLQT5S.jsView file

187var _require = createRequire(import.meta.url); L188: var { version: VERSION } = _require("../package.json"); L189: var TELEMETRY_ENDPOINT = "https://canonry.ai/api/telemetry"; L190: var TIMEOUT_MS = 3e3; ... L201: function isTelemetryEnabled() { L202: if (process.env.CANONRY_TELEMETRY_DISABLED === "1") return false; L203: if (process.env.DO_NOT_TRACK === "1") return false; L204: if (process.env.CI) return false; L205: if (!configExists()) return true; ... L243: try { L244: const hostname = os.hostname() || ""; L245: const mac = firstNonInternalMac();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/chunk-YEOLQT5S.jsView on unpkg · L187

dist/chunk-3HKBUYIY.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-3HKBUYIY.jsView on unpkg

Findings

1 Critical4 High4 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/chunk-3HKBUYIY.js

HighChild Processdist/cli.js

HighShell

HighSame File Env Network Executiondist/cli.js

HighHost Fingerprint Exfiltrationdist/chunk-YEOLQT5S.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 4868-4908javascript

4868 publicUrl: opts.publicUrl

4869 });

4870 if (isMachineFormat(opts.format)) {

4871 console.log(JSON.stringify({

4872 project,

4873 type: opts.type,

4874 authUrl,

4875 redirectUri: redirectUri ?? null

4876 }, null, 2));

4877 return;

4878 }

4879 console.log(`

4880Open this URL in your browser to authorize Google ${opts.type.toUpperCase()} access:

4881`);

4882 console.log(` ${authUrl}

4883`);

4884 if (redirectUri) {

4885 console.log(`Redirect URI: ${redirectUri}`);

4886 console.log("(Ensure this URI is listed in your Google Cloud Console OAuth client's authorized redirect URIs)\n");

4887 }

4888 try {

4889 const { spawn: spawn2 } = await import("child_process");

4890 const platform = process.platform;

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L4888

4891 const [cmd, ...extraArgs] = platform === "darwin" ? ["open", authUrl] : platform === "win32" ? ["cmd", "/c", "start", "", authUrl] : ["xdg-open", authUrl];

4892 spawn2(cmd, [...extraArgs], { detached: true, stdio: "ignore" }).unref();

4893 console.log("(Browser opened automatically)");

4894 } catch {

4895 console.log("(Could not open browser automatically \u2014 please copy the URL above)");

4896 }

4897}

4898async function googleDisconnect(project, opts) {

4899 const client = getClient10();

4900 await client.googleDisconnect(project, opts.type);

4901 if (isMachineFormat(opts.format)) {

4902 console.log(JSON.stringify({ project, type: opts.type, disconnected: true }, null, 2));

4903 return;

4904 }

4905 console.log(`Disconnected Google ${opts.type.toUpperCase()} from project "${project}".`);

4906}

4907async function googleStatus(project, format) {

4908 const client = getClient10();

Lines 10328-10368javascript

10328 tx.insert(apiKeys).values({

10329 id: crypto.randomUUID(),

10330 name: "default",

10331 keyHash,

10332 keyPrefix,

10333 scopes: ["*"],

10334 createdAt: (/* @__PURE__ */ new Date()).toISOString()

10335 }).run();

dist/chunk-YEOLQT5S.jsView file

Lines 167-207javascript

167 isRetryableHttpError,

168 normalizeIdTokens,

169 normalizeUrlPath,

170 notFound,

171 parseOriginList,

172 providerError,

173 resolveSnapshotRequestQueries,

174 serializeForInlineScript,

175 serializeRunError,

176 skillsClientSchema,

177 splitList,

178 validationError,

179

dist/chunk-3HKBUYIY.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-3HKBUYIY.jsView on unpkg