registry / @canonry/canonry / 7.51.0
@canonry/canonry@7.51.0
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe scanner’s credential and child-process flags resolve to local dashboard authentication, an optional plugin installer, and a configured TypeSafe classification integration. The TypeSafe install setting defaults to disabled, and the agent setup runs through canonry init against the current project.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Sentiment classification can dispatch when installation settings are enabled and ready and a project has sentiment analysis enabled.
Impact
The configured TypeSafe service receives classification requests. No unrelated credential transfer or unconsented installation-time mutation was established.
Mechanism
The classifier posts its request with the configured TypeSafe bearer key to https://api.typesafe.ai/v1/systemone. The CLI setup path can add the package’s own skills and MCP entry to the current project.
AI rationale
The scanner’s credential and child-process flags resolve to local dashboard authentication, an optional plugin installer, and a configured TypeSafe classification integration. The TypeSafe install setting defaults to disabled, and the agent setup runs through canonry init against the current project.
Network endpoints1
api.typesafe.ai/v1/systemone
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json exposes CLI entry points and defines no npm install lifecycle hook.
- The flagged browser login fields are used by the local login handler and credential verifier.
- The flagged child process installs a DuckDB plugin into a plugin directory using npm or pnpm.
- The TypeSafe classifier sends its configured service key and request to its named endpoint; dispatch requires enabled, ready settings.
- canonry init installs the package’s own skills and project MCP entry, with skip options and a project-local MCP config path.
- The other inspected required files are application bundles, public type declarations, or the declared Fastify and MCP dependencies.
Evidence against
- The package has credentialed network traffic for sentiment classification and can modify project agent configuration when canonry init runs.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
8 flaggeddist/chunk-UJLIMXPX.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @canonry/canonry@7.50.1
matchedIdentity = npm:QGNhbm9ucnkvY2Fub25yeQ:7.50.1
similarity = 0.886
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-UJLIMXPX.jsView on unpkg65011// ../integration-commoncrawl/src/plugin-installer.ts
L65012: import { spawn } from "child_process";
L65013: import fs4 from "fs/promises";
High
Child Process
Package source references child process execution.
dist/chunk-UJLIMXPX.jsView on unpkg · L65011•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/chunk-UJLIMXPX.js:
oauthAuthorizationCodes: () => oauthAuthorizationCodes,
// are untrusted correlation metadata, never authorization identities.
var oauthAuthorizationCodes = sqliteTable("oauth_authorization_codes", {
* replay, plus each attempt the provider refused for rate limit or authorization.
// Opt-in single-project scoping for API keys. NULL = full-instance access
// there is no account to infer from an API key, and inventing one would
name: "oauth-authorization-server",
// Enterprise) cannot present an API key, so this is the only way they can
Findings
3 Critical5 High3 Medium6 Low
CriticalBrowser Credential Phishingdist/chunk-77T24PPR.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-77T24PPR.js
CriticalPrevious Version Dangerous Deltadist/chunk-UJLIMXPX.js
HighChild Processdist/chunk-UJLIMXPX.js
HighCredential Redirect Persistencedist/chunk-UJLIMXPX.js
HighCommand Output Exfiltrationdist/chunk-UJLIMXPX.js
HighCross File Remote Execution Contextdist/chunk-T4EXTQQK.js
HighSemantic Analysis Limiteddist/chunk-UJLIMXPX.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to @canonry/canonry@7.51.0.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.51.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.