registry / @canonry/canonry / 7.59.0
@canonry/canonry@7.59.0
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 11d ago · by lpm-firewall-aiSource inspection found no npm install hook or concrete malicious behavior. The flagged credential request is part of the named TypeSafe integration, and the reviewed agent skill updates are limited to manifest-marked package-owned locations while preserving local edits by default.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Ordinary CLI setup, configured provider use, or application API use activates the reviewed behavior.
Impact
No attack impact was identified.
Mechanism
The inspected code performs provider requests, managed skill synchronization, local login validation, and feature-specific dependency setup; no malicious transfer or unauthorized mutation was established.
AI rationale
Source inspection found no npm install hook or concrete malicious behavior. The flagged credential request is part of the named TypeSafe integration, and the reviewed agent skill updates are limited to manifest-marked package-owned locations while preserving local edits by default.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares CLI and module entrypoints, with build, typecheck, test, and lint scripts but no npm install lifecycle hook; inspected dependency manifests show build or test scripts, not install hooks.
- The configured TypeSafe classifier sends its API key to the named TypeSafe endpoint; the classifier selects a separate OpenRouter path when configured for OpenRouter.
- Skill setup targets a project or the user’s home directory. Automatic sync is limited to directories with a Canonry skill manifest, and edited files are preserved unless force is requested.
- The agent runtime callback enforces tool-call limits and records successful assistant usage to an optional database; no unrelated account action was identified.
- The flagged password fields belong to the application’s local login request schema. The inspected web and parser bundles, traffic module, and Common Crawl DuckDB installer match application functionality; no browser credential transfer was established.
- The prepared Fastify and agent-core dependency sources have ordinary package entrypoints and no install lifecycle hooks.
Evidence against
Source & flagged code
9 flaggeddist/traffic-LALKHOSD.jsView file
43// src/cloudflare-worker-deploy.ts
L44: import { spawn } from "child_process";
L45: import { randomUUID } from "crypto";
High
Child Process
Package source references child process execution.
dist/traffic-LALKHOSD.jsView on unpkg · L43dist/chunk-HKLI6ZFP.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/chunk-HKLI6ZFP.js:
let sanitized = value.replace(/(authorization\s*:\s*bearer\s+)[^\s,"'}]+/gi, "$1***").replace(/((?:developer|access)[_-]?token\s*[:=]\s*["']?)[^\s,"'}]+/gi, "$1***");
Authorization: `Bearer ${this.#accessToken}`,
authorization: `Bearer ${accessToken}`,
Authorization: `Basic ${Buffer.from(`${credentials.login}:${credentials.password}`).toString("base64")}`,
headers: { authorization: `Bearer ${options.apiKey}`, "content-type": "application/json" },
const code = response.status === 401 || response.status === 403 ? "provider-authorization" : response.status === 413 ? "provider-context-limit" : response.status === 42
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
4 Critical5 High3 Medium5 Low
CriticalBrowser Credential Phishingdist/chunk-HUO3YPKB.js
CriticalTrojan Source Unicodeassets/assets/vendor-yaml-Y43rmNgW.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-HUO3YPKB.js
CriticalPrevious Version Dangerous Deltadist/chunk-WSFCQQ7F.js
HighChild Processdist/traffic-LALKHOSD.js
HighCredential Redirect Persistencedist/chunk-HKLI6ZFP.js
HighCommand Output Exfiltrationdist/chunk-WSFCQQ7F.js
HighCross File Remote Execution Contextdist/chunk-GS6IH7CI.js
HighSemantic Analysis Limiteddist/chunk-WSFCQQ7F.js
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @canonry/canonry@7.59.0.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.59.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.