registry / @canonry/canonry / 7.48.0
@canonry/canonry@7.48.0
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe scanner's credential-phishing hint resolves to an application login schema, and the TypeSafe credential flow is a provider request to its named endpoint. The remaining concern is automatic refresh of installed agent skills during CLI use, so this warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A non-stored-only Canonry CLI command runs while configuration exists and a sync is due; the sync can be disabled with its environment flag.
Impact
Agent guidance can change automatically after a package update, without a separate approval for that update. No credential theft or other concrete attack was identified.
Mechanism
The CLI finds directories with manifest-marked bundled skills and reconciles their files against the package copies. Locally edited files are kept unless force is enabled.
AI rationale
The scanner's credential-phishing hint resolves to an application login schema, and the TypeSafe credential flow is a provider request to its named endpoint. The remaining concern is automatic refresh of installed agent skills during CLI use, so this warrants a warning rather than a block.
Evidence
dist/cli.jsdist/chunk-NPYNNEFP.jsdist/chunk-CS4POCLI.jsdist/chunk-PTDX75HP.js.claude/skills/<bundled-skill>
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes CLI entrypoints and has no npm install lifecycle hook.
- The CLI asynchronously starts skill synchronization during ordinary commands. Synchronization is skipped when disabled, when configuration is absent, and until the package version changes or the check interval elapses.
- Synchronization targets directories containing manifest-marked bundled Canonry skills. It updates stale bundled files and leaves manually edited files alone unless forced.
- Skill installation is also available through explicit `skills install` and project initialization commands.
- The flagged password schema is an application login request; the TypeSafe code sends a configured API key to the named TypeSafe evaluation endpoint.
- The other flagged agent locations select configuration paths or check whether skills are installed; the declaration file contains API types.
Evidence against
- There is no npm lifecycle trigger or evidence of credential theft.
- Automatic updates are limited to existing Canonry skills, and edited files are preserved unless an explicit force option is used.
Behavioral surface
Source & flagged code
8 flaggeddist/chunk-U2GU6MAC.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @canonry/canonry@7.46.1
matchedIdentity = npm:QGNhbm9ucnkvY2Fub25yeQ:7.46.1
similarity = 0.932
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-U2GU6MAC.jsView on unpkg64831// ../integration-commoncrawl/src/plugin-installer.ts
L64832: import { spawn } from "child_process";
L64833: import fs4 from "fs/promises";
High
Child Process
Package source references child process execution.
dist/chunk-U2GU6MAC.jsView on unpkg · L64831997gscQueryDailyTotals: () => gscQueryDailyTotals,
L998: gscSearchData: () => gscSearchData,
L999: gscUrlInspections: () => gscUrlInspections,
...
L4168: try {
L4169: return JSON.parse(value);
L4170: } catch {
...
L4702: // ga_connections
L4703: // WARNING: private_key is authentication material; consider storing in config.yaml per AGENTS.md
L4704: `CREATE TABLE IF NOT EXISTS ga_connections (
...
L12300: try {
L12301: const parsed = new URL(/^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`);
L12302: return parsed.hostname.toLowerCase().replace(/\.$/, "") || null;
Findings
3 Critical5 High3 Medium6 Low
CriticalBrowser Credential Phishingdist/chunk-NVKQVQ3C.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-NVKQVQ3C.js
CriticalPrevious Version Dangerous Deltadist/chunk-U2GU6MAC.js
HighChild Processdist/chunk-U2GU6MAC.js
HighCredential Redirect Persistencedist/chunk-BNZ3N6UX.js
HighCommand Output Exfiltrationdist/chunk-U2GU6MAC.js
HighCross File Remote Execution Contextdist/chunk-PTDX75HP.js
HighSemantic Analysis Limiteddist/chunk-U2GU6MAC.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to @canonry/canonry@7.48.0.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.48.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.