registry / @canonry/canonry / 7.51.6
@canonry/canonry@7.51.6
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 14d ago · by lpm-firewall-aiSource inspection found no install lifecycle hook or confirmed attack behavior. The flagged credential, shell, agent setup, and Unicode signals resolve to purpose-specific features, explicit operations, ordinary application code, and YAML byte-order-mark handling.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The sentiment classifier requires configuration to enable it; the DuckDB installer runs through the backlinks installation handler.
Impact
No unconsented credential disclosure, agent configuration mutation, or destructive effect was established.
Mechanism
The classifier sends its dedicated configured key to its classifier endpoint. The installer invokes the selected package manager for the plugin directory.
AI rationale
Source inspection found no install lifecycle hook or confirmed attack behavior. The flagged credential, shell, agent setup, and Unicode signals resolve to purpose-specific features, explicit operations, ordinary application code, and YAML byte-order-mark handling.
Network endpoints1
api.typesafe.ai/v1/systemone
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares CLI and library entrypoints, with build and development scripts but no install lifecycle hook.
- The TypeSafe classifier uses a dedicated configured key and is disabled by default; its request goes to its classifier endpoint.
- The flagged password references belong to application login contracts, and diagnostic code redacts secret values.
- Skill installation is exposed through an explicit CLI command; the server excerpt checks for an existing Canonry plugin configuration.
- The flagged child process is a package-manager install into a plugin directory, invoked by the product's backlinks installation handler.
- Other flagged excerpts resolve to ordinary agent usage accounting, database schema, application assets, a temporary preflight fixture, YAML parser BOM handling, and dependencies without install hooks.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
8 flaggeddist/chunk-DGVUTH7W.jsView file
56217// ../integration-commoncrawl/src/plugin-installer.ts
L56218: import { spawn } from "child_process";
L56219: import fs4 from "fs/promises";
High
Child Process
Package source references child process execution.
dist/chunk-DGVUTH7W.jsView on unpkg · L562171078});
L1079: return `${PREFIX}${salt.toString("base64")}$${derived.toString("base64")}`;
L1080: }
...
L1385: });
L1386: app.post("/auth/login", async (request, reply) => {
L1387: const parsed = loginRequestSchema.safeParse(request.body);
...
L4672: try {
L4673: const parsed = new URL(/^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`);
L4674: return parsed.hostname.toLowerCase().replace(/\.$/, "") || null;
...
L7535: <label for="name">Name</label><input id="name" name="name" autocomplete="username" autofocus>
L7536: <label for="password">Password</label><input id="password" name="password" type="password" autocomplete="current-password">
L7537: <button type="submit">Sign in</button>`, action);
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/chunk-DGVUTH7W.jsView on unpkg · L1078•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2
Findings
3 Critical5 High3 Medium5 Low
CriticalBrowser Credential Phishingdist/chunk-D6COIM3U.js
CriticalTrojan Source Unicodeassets/assets/vendor-yaml-Y43rmNgW.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-D6COIM3U.js
HighChild Processdist/chunk-DGVUTH7W.js
HighCredential Redirect Persistencedist/chunk-6G6FTDWC.js
HighCommand Output Exfiltrationdist/chunk-DGVUTH7W.js
HighCross File Remote Execution Contextdist/chunk-VYMZ3QXG.js
HighSemantic Analysis Limiteddist/chunk-DGVUTH7W.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to @canonry/canonry@7.51.6.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.51.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.