registry / @canonry/canonry / 7.51.5
@canonry/canonry@7.51.5
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 14d ago · by lpm-firewall-aiSource inspection found no install-time attack or credential transfer to an unrelated recipient. The scanner’s credential and browser-collection matches correspond to TypeSafe provider traffic and secret-redaction logic, while agent skills are installed through an explicit CLI action.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
No malicious trigger was identified; skill installation requires an explicit CLI command, and TypeSafe requests occur during sentiment evaluation.
Impact
No confirmed attack impact was established.
Mechanism
The installer writes bundled skills under the selected project or user directory and preserves local edits. The TypeSafe client sends the supplied key and evaluation request to the TypeSafe service.
AI rationale
Source inspection found no install-time attack or credential transfer to an unrelated recipient. The scanner’s credential and browser-collection matches correspond to TypeSafe provider traffic and secret-redaction logic, while agent skills are installed through an explicit CLI action.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes CLI and runtime entrypoints and defines build, typecheck, test, and lint scripts, with no install lifecycle hook.
- The skill installer writes bundled skills to a project or user skill directory when called; it preserves prior manifests and local edits, and the CLI offers installation as an explicit command.
- The TypeSafe client sends its supplied API key and evaluation request to the fixed TypeSafe API endpoint; the runtime records this as a TypeSafe sentiment evaluation.
- The password and credential matches in the flagged UI chunk are secret-detection and redaction patterns.
- The flagged runtime and UI paths contain application modules, type declarations, UI bundles, and declared dependencies; the inspected dependency entrypoints are for rate limiting, static-file serving, and MCP stdio transport.
- The YAML asset begins with YAML parser data structures and traversal logic consistent with a bundled parser.
Evidence against
- Scanner labels for browser credential phishing, Trojan Source, and a credential redirect were not borne out by the inspected source excerpts.
- No package install hook or unconsented automatic agent configuration mutation was identified.
Source & flagged code
9 flaggeddist/chunk-A3WSAAQS.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @canonry/canonry@7.51.6
matchedIdentity = npm:QGNhbm9ucnkvY2Fub25yeQ:7.51.6
similarity = 0.673
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-A3WSAAQS.jsView on unpkg65019// ../integration-commoncrawl/src/plugin-installer.ts
L65020: import { spawn } from "child_process";
L65021: import fs4 from "fs/promises";
High
Child Process
Package source references child process execution.
dist/chunk-A3WSAAQS.jsView on unpkg · L65019•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/chunk-A3WSAAQS.js:
oauthAuthorizationCodes: () => oauthAuthorizationCodes,
// are untrusted correlation metadata, never authorization identities.
var oauthAuthorizationCodes = sqliteTable("oauth_authorization_codes", {
* replay, plus each attempt the provider refused for rate limit or authorization.
// Opt-in single-project scoping for API keys. NULL = full-instance access
// there is no account to infer from an API key, and inventing one would
name: "oauth-authorization-server",
// Enterprise) cannot present an API key, so this is the only way they can
Findings
4 Critical5 High3 Medium5 Low
CriticalBrowser Credential Phishingdist/chunk-SFMWHPMX.js
CriticalTrojan Source Unicodeassets/assets/vendor-yaml-Y43rmNgW.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-SFMWHPMX.js
CriticalPrevious Version Dangerous Deltadist/chunk-A3WSAAQS.js
HighChild Processdist/chunk-A3WSAAQS.js
HighCredential Redirect Persistencedist/chunk-A3WSAAQS.js
HighCommand Output Exfiltrationdist/chunk-A3WSAAQS.js
HighCross File Remote Execution Contextdist/chunk-4QQYYRHV.js
HighSemantic Analysis Limiteddist/chunk-A3WSAAQS.js
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @canonry/canonry@7.51.5.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.51.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.