registry / @canonry/canonry / 7.22.0
@canonry/canonry@7.22.0
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe manifest has no lifecycle hook, and inspected required source locations do not substantiate the scanner's credential-exfiltration or browser-phishing claims. The excerpts support ordinary CLI and skill-management behavior, so the package is clean on the available source evidence.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
No malicious trigger was identified; agent configuration and skill operations are associated with CLI use.
Impact
No confirmed attack impact was established.
Mechanism
The inspected locations check skill presence, describe updates, or define configuration paths; they do not establish credential exfiltration or unconsented install-time mutation.
AI rationale
The manifest has no lifecycle hook, and inspected required source locations do not substantiate the scanner's credential-exfiltration or browser-phishing claims. The excerpts support ordinary CLI and skill-management behavior, so the package is clean on the available source evidence.
Decision evidence
public snapshotAI called this Clean at 78.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes CLI entrypoints and has no install lifecycle hook.
- The flagged chunk checks required skills and reports missing items; this excerpt does not show credential collection or transmission.
- The skill helper checks existing Claude and Codex skill paths.
- The plugin-related excerpt formats an update hint for Canonry in an agent client.
- The skill installer reports install or update status and preserves local edits unless forced.
- The CLI excerpt defines agent-client configuration paths; no install-time configuration mutation is shown.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
9 flaggeddist/chunk-46JZR2IV.jsView file
936gscQueryDailyTotals: () => gscQueryDailyTotals,
L937: gscSearchData: () => gscSearchData,
L938: gscUrlInspections: () => gscUrlInspections,
...
L4057: try {
L4058: return JSON.parse(value);
L4059: } catch {
...
L4591: // ga_connections
L4592: // WARNING: private_key is authentication material; consider storing in config.yaml per AGENTS.md
L4593: `CREATE TABLE IF NOT EXISTS ga_connections (
...
L11883: try {
L11884: const parsed = new URL(/^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`);
L11885: return parsed.hostname.toLowerCase().replace(/\.$/, "") || null;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/chunk-46JZR2IV.jsView on unpkg · L936936Trigger-reachable chain: manifest.exports -> dist/index.js -> dist/chunk-46JZR2IV.js
L936: gscQueryDailyTotals: () => gscQueryDailyTotals,
L937: gscSearchData: () => gscSearchData,
L938: gscUrlInspections: () => gscUrlInspections,
...
L4057: try {
L4058: return JSON.parse(value);
L4059: } catch {
...
L4591: // ga_connections
L4592: // WARNING: private_key is authentication material; consider storing in config.yaml per AGENTS.md
L4593: `CREATE TABLE IF NOT EXISTS ga_connections (
...
L11883: try {
L11884: const parsed = new URL(/^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`);
L11885: return parsed.hostname.toLowerCase().replace(/\.$/, "") || null;
Critical
Trigger Reachable Dangerous Capability
Findings
4 Critical5 High3 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/chunk-46JZR2IV.js
CriticalBrowser Credential Phishingdist/chunk-MRKV43TV.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-46JZR2IV.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/chunk-46JZR2IV.js
HighCredential Redirect Persistencedist/chunk-46JZR2IV.js
HighCommand Output Exfiltrationdist/chunk-46JZR2IV.js
HighCross File Remote Execution Contextdist/cli.js
HighSemantic Analysis Limiteddist/chunk-46JZR2IV.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @canonry/canonry@7.22.0.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.22.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.