registry / @canonry/canonry / 4.110.0

@canonry/canonry@4.110.0

Agent-first open-source AEO operating platform - track how answer engines cite your domain

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 4.38 MB of source, external domains: accounts.google.com, aistudio.google.com, analyticsdata.googleapis.com, api.ads.openai.com, api.deepinfra.com, api.perplexity.ai, bit.ly, brightkidsdental.com, businessprofileperformance.googleapis.com, canonry.ai, canonry.local, citypointdental.com, commoncrawl.org, console.cloud.google.com, console.developers.google.com, data.commoncrawl.org, developers.google.com, downtownsmiles.com, example.com, github.com, harbordental.com, hooks.example.com, indexing.googleapis.com, json-schema.org, logging.googleapis.com, mybusinessaccountmanagement.googleapis.com, mybusinessbusinessinformation.googleapis.com, mybusinesslodging.googleapis.com, oauth2.googleapis.com, openai.com, parkpediatricdental.com, places.googleapis.com, platform.claude.com, platform.openai.com, radix-ui.com, rdap.arin.net, react.dev, redacted.invalid, redux-toolkit.js.org, redux.js.org, registry.npmjs.org, schema.org, searchconsole.googleapis.com, ssl.bing.com, support.google.com, vercel.com, www.bing.com, www.googleapis.com, www.npmjs.com, www.perplexity.ai

Source & flagged code

3 flagged

dist/chunk-JGRVQJHX.jsView file

25867// ../integration-commoncrawl/src/plugin-installer.ts L25868: import { spawn } from "child_process"; L25869: import fs4 from "fs/promises";

High

Child Process

Package source references child process execution.

dist/chunk-JGRVQJHX.jsView on unpkg · L25867

dist/cli.jsView file

Lines 10333-10373javascript

10333 tx.insert(apiKeys).values({

10334 id: crypto.randomUUID(),

10335 name: "default",

10336 keyHash,

10337 keyPrefix,

10338 scopes: ["*"],

10339 createdAt: (/* @__PURE__ */ new Date()).toISOString()

10340 }).run();

10341 });

10342 saveConfig({

10343 apiUrl: env.apiUrl || existingConfig?.apiUrl || `http://localhost:${process.env.CANONRY_PORT || "4100"}`,

10344 database: databasePath,

10345 apiKey: rawApiKey,

10346 providers: mergedProviders,

10347 google: mergedGoogle

10348 });

10349 if (format === "json") {

10350 console.log(JSON.stringify({

10351 bootstrapped: true,

10352 configPath: getConfigPath(),

10353 databasePath,

10354 apiUrl: env.apiUrl || existingConfig?.apiUrl || `http://localhost:${process.env.CANONRY_PORT || "4100"}`,

10355 providers: Object.keys(mergedProviders ?? {}),

10356 googleConfigured: !!mergedGoogle,

10357 generatedApiKey

10358 }, null, 2));

10359 return;

10360 }

10361 console.log(`Bootstrap complete. Config saved to ${getConfigPath()}`);

10362 console.log(`SQLite database path: ${databasePath}`);

10363 if (generatedApiKey) {

10364 console.log(`API key: ${generatedApiKey}`);

10365 }

10366}

10367

10368// src/commands/daemon.ts

10369import { spawn } from "child_process";

10370import fs9 from "fs";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L10353

10371import path7 from "path";

10372function getPidPath() {

10373 return path7.join(getConfigDir(), "canonry.pid");

dist/chunk-6PHBWPPN.jsView file

Lines 167-207javascript

167 isRetryableHttpError,

168 normalizeIdTokens,

169 normalizeUrlPath,

170 notFound,

171 parseOriginList,

172 providerError,

173 resolveSnapshotRequestQueries,

174 serializeForInlineScript,

175 serializeRunError,

176 skillsClientSchema,

177 splitList,

178 validationError,

179

Source & flagged code

3 flagged · loading source

dist/chunk-JGRVQJHX.jsView file

25867// ../integration-commoncrawl/src/plugin-installer.ts L25868: import { spawn } from "child_process"; L25869: import fs4 from "fs/promises";

High

Child Process

Package source references child process execution.

dist/chunk-JGRVQJHX.jsView on unpkg · L25867

dist/cli.jsView file

10353databasePath, L10354: apiUrl: env.apiUrl || existingConfig?.apiUrl || `http://localhost:${process.env.CANONRY_PORT || "4100"}`, L10355: providers: Object.keys(mergedProviders ?? {}), ... L10368: // src/commands/daemon.ts L10369: import { spawn } from "child_process"; L10370: import fs9 from "fs";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L10353

dist/chunk-6PHBWPPN.jsView file

187var _require = createRequire(import.meta.url); L188: var { version: VERSION } = _require("../package.json"); L189: var TELEMETRY_ENDPOINT = "https://canonry.ai/api/telemetry"; L190: var TIMEOUT_MS = 3e3; ... L201: function isTelemetryEnabled() { L202: if (process.env.CANONRY_TELEMETRY_DISABLED === "1") return false; L203: if (process.env.DO_NOT_TRACK === "1") return false; L204: if (process.env.CI) return false; L205: if (!configExists()) return true; ... L243: try { L244: const hostname = os.hostname() || ""; L245: const mac = firstNonInternalMac();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/chunk-6PHBWPPN.jsView on unpkg · L187

Findings

4 High4 Medium6 Low

HighChild Processdist/chunk-JGRVQJHX.js

HighShell

HighSame File Env Network Executiondist/cli.js

HighHost Fingerprint Exfiltrationdist/chunk-6PHBWPPN.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

3 flagged

dist/chunk-JGRVQJHX.jsView file

25867// ../integration-commoncrawl/src/plugin-installer.ts L25868: import { spawn } from "child_process"; L25869: import fs4 from "fs/promises";

High

Child Process

Package source references child process execution.

dist/chunk-JGRVQJHX.jsView on unpkg · L25867

dist/cli.jsView file

Lines 10333-10373javascript

10333 tx.insert(apiKeys).values({

10334 id: crypto.randomUUID(),

10335 name: "default",

10336 keyHash,

10337 keyPrefix,

10338 scopes: ["*"],

10339 createdAt: (/* @__PURE__ */ new Date()).toISOString()

10340 }).run();

10341 });

10342 saveConfig({

10343 apiUrl: env.apiUrl || existingConfig?.apiUrl || `http://localhost:${process.env.CANONRY_PORT || "4100"}`,

10344 database: databasePath,

10345 apiKey: rawApiKey,

10346 providers: mergedProviders,

10347 google: mergedGoogle

10348 });

10349 if (format === "json") {

10350 console.log(JSON.stringify({

10351 bootstrapped: true,

10352 configPath: getConfigPath(),

10353 databasePath,

10354 apiUrl: env.apiUrl || existingConfig?.apiUrl || `http://localhost:${process.env.CANONRY_PORT || "4100"}`,

10355 providers: Object.keys(mergedProviders ?? {}),

10356 googleConfigured: !!mergedGoogle,

10357 generatedApiKey

10358 }, null, 2));

10359 return;

10360 }

10361 console.log(`Bootstrap complete. Config saved to ${getConfigPath()}`);

10362 console.log(`SQLite database path: ${databasePath}`);

10363 if (generatedApiKey) {

10364 console.log(`API key: ${generatedApiKey}`);

10365 }

10366}

10367

10368// src/commands/daemon.ts

10369import { spawn } from "child_process";

10370import fs9 from "fs";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L10353

10371import path7 from "path";

10372function getPidPath() {

10373 return path7.join(getConfigDir(), "canonry.pid");

dist/chunk-6PHBWPPN.jsView file

Lines 167-207javascript

167 isRetryableHttpError,

168 normalizeIdTokens,

169 normalizeUrlPath,

170 notFound,

171 parseOriginList,

172 providerError,

173 resolveSnapshotRequestQueries,

174 serializeForInlineScript,

175 serializeRunError,

176 skillsClientSchema,

177 splitList,

178 validationError,

179