registry / @canonry/canonry / 7.54.0
@canonry/canonry@7.54.0
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe source contains no npm install lifecycle hook, and the scanner's credential, agent-configuration, and child-process indicators resolve to configured provider use, explicit skill installation, read-only setup checks, and a product installer callback. The inspected source supports a clean verdict.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A configured sentiment evaluation or a user-run skills install command.
Impact
No confirmed credential theft, install-time mutation, or foreign agent control was established.
Mechanism
The TypeSafe classifier sends its configured key to the TypeSafe endpoint with a classification request; the skills command installs bundled files, while the MCP check reads existing configuration.
AI rationale
The source contains no npm install lifecycle hook, and the scanner's credential, agent-configuration, and child-process indicators resolve to configured provider use, explicit skill installation, read-only setup checks, and a product installer callback. The inspected source supports a clean verdict.
Network endpoints1
api.typesafe.ai/v1/systemone
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json lists build and development scripts but no npm install lifecycle hook.
- The TypeSafe sentiment provider is disabled by default and accepts a configured provider key; its classifier sends that key to the fixed TypeSafe service endpoint.
- Agent skill files are written by the skills install command, which accepts explicitly requested skills and targets.
- The flagged MCP setup code reads existing configuration and checks for the Canonry server command.
- The agent callback counts tool calls and records usage only for successful assistant turns.
- The other required source paths show API declarations, integration and provider UI, secret redaction, a YAML parser, and inspected library dependencies; they do not establish credential harvesting or install-time agent control.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
9 flaggeddist/chunk-PRNO5TLE.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @canonry/canonry@7.51.6
matchedIdentity = npm:QGNhbm9ucnkvY2Fub25yeQ:7.51.6
similarity = 0.742
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-PRNO5TLE.jsView on unpkg57101// ../integration-commoncrawl/src/plugin-installer.ts
L57102: import { spawn } from "child_process";
L57103: import fs4 from "fs/promises";
High
Child Process
Package source references child process execution.
dist/chunk-PRNO5TLE.jsView on unpkg · L571011097});
L1098: return `${PREFIX}${salt.toString("base64")}$${derived.toString("base64")}`;
L1099: }
...
L1404: });
L1405: app.post("/auth/login", async (request, reply) => {
L1406: const parsed = loginRequestSchema.safeParse(request.body);
...
L4865: try {
L4866: const parsed = new URL(/^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`);
L4867: return parsed.hostname.toLowerCase().replace(/\.$/, "") || null;
...
L6587: if (first === 10 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168) {
L6588: return "which is private space";
L6589: }
Findings
4 Critical5 High3 Medium5 Low
CriticalBrowser Credential Phishingdist/chunk-OMXWBR2R.js
CriticalTrojan Source Unicodeassets/assets/vendor-yaml-Y43rmNgW.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-OMXWBR2R.js
CriticalPrevious Version Dangerous Deltadist/chunk-PRNO5TLE.js
HighChild Processdist/chunk-PRNO5TLE.js
HighCredential Redirect Persistencedist/chunk-2SY2FYFW.js
HighCommand Output Exfiltrationdist/chunk-PRNO5TLE.js
HighCross File Remote Execution Contextdist/chunk-PFPTUCMG.js
HighSemantic Analysis Limiteddist/chunk-PRNO5TLE.js
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @canonry/canonry@7.54.0.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.54.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.