registry / @canonry/canonry / 7.17.2
@canonry/canonry@7.17.2
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe source supports package-aligned evaluator authentication and package telemetry, with no install hook in the manifest or demonstrated foreign agent-control mutation. Scanner labels alone do not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The TypeSafe request runs when the application invokes that evaluator; telemetry is sent by CLI activity.
Impact
No confirmed attack surface was established by these behaviors.
Mechanism
The evaluator posts its request with the configured key to the fixed TypeSafe endpoint and rejects redirects. Telemetry is sent to canonry.ai.
AI rationale
The source supports package-aligned evaluator authentication and package telemetry, with no install hook in the manifest or demonstrated foreign agent-control mutation. Scanner labels alone do not establish malicious behavior.
Network endpoints2
api.typesafe.ai/v1/systemonecanonry.ai/api/telemetry
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies Canonry as a self-hosted AI visibility platform and exposes CLI binaries; its scripts contain no install lifecycle hook.
- The required agent-integration locations show skill discovery, installation-status reporting, and agent config path helpers; these excerpts do not establish unconsented install-time mutation.
- The TypeSafe integration sends its configured API key as a bearer token to its fixed evaluator endpoint, with redirects disabled; the source identifies it as a dedicated integration.
- Telemetry targets the package's canonry.ai endpoint.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
9 flaggeddist/chunk-YJS4OE6I.jsView file
927gscQueryDailyTotals: () => gscQueryDailyTotals,
L928: gscSearchData: () => gscSearchData,
L929: gscUrlInspections: () => gscUrlInspections,
...
L4048: try {
L4049: return JSON.parse(value);
L4050: } catch {
...
L4582: // ga_connections
L4583: // WARNING: private_key is authentication material; consider storing in config.yaml per AGENTS.md
L4584: `CREATE TABLE IF NOT EXISTS ga_connections (
...
L11874: try {
L11875: const parsed = new URL(/^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`);
L11876: return parsed.hostname.toLowerCase().replace(/\.$/, "") || null;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/chunk-YJS4OE6I.jsView on unpkg · L92762283// ../integration-commoncrawl/src/plugin-installer.ts
L62284: import { spawn } from "child_process";
L62285: import fs4 from "fs/promises";
High
Child Process
Package source references child process execution.
dist/chunk-YJS4OE6I.jsView on unpkg · L62283927gscQueryDailyTotals: () => gscQueryDailyTotals,
L928: gscSearchData: () => gscSearchData,
L929: gscUrlInspections: () => gscUrlInspections,
...
L4048: try {
L4049: return JSON.parse(value);
L4050: } catch {
...
L4582: // ga_connections
L4583: // WARNING: private_key is authentication material; consider storing in config.yaml per AGENTS.md
L4584: `CREATE TABLE IF NOT EXISTS ga_connections (
...
L11874: try {
L11875: const parsed = new URL(/^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`);
L11876: return parsed.hostname.toLowerCase().replace(/\.$/, "") || null;
Findings
4 Critical5 High3 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/chunk-YJS4OE6I.js
CriticalBrowser Credential Phishingdist/chunk-MIRAKDRW.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-MIRAKDRW.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/chunk-YJS4OE6I.js
HighCredential Redirect Persistencedist/chunk-3LPQ4JV5.js
HighCommand Output Exfiltrationdist/chunk-YJS4OE6I.js
HighCross File Remote Execution Contextdist/cli.js
HighSemantic Analysis Limiteddist/chunk-YJS4OE6I.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @canonry/canonry@7.17.2.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.17.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.