registry / @canonry/canonry / 7.64.4
@canonry/canonry@7.64.4
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 10d ago · by lpm-firewall-aiSource inspection found no install hook or concrete attack behavior. The credential and browser-collection alerts are explained by provider-specific configuration and log-redaction code.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
No unconsented install or import-time trigger was found; provider requests occur when configured features run.
Impact
No unauthorized credential transfer, agent configuration abuse, or other attack impact was established.
Mechanism
Provider keys are assigned to their named integrations; the TypeSafe evaluator uses its separate key for its TypeSafe endpoint.
AI rationale
Source inspection found no install hook or concrete attack behavior. The credential and browser-collection alerts are explained by provider-specific configuration and log-redaction code.
Network endpoints1
api.typesafe.ai/v1/systemone
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no npm install lifecycle hooks; its scripts are build, typecheck, test, and lint tasks.
- Agent skill files are installed by an explicit CLI command or during user-invoked initialization, into the selected project or user directory.
- The Anthropic key is stored under the Claude provider; the separate TypeSafe evaluator uses a TypeSafe-specific key and sends requests to its TypeSafe endpoint.
- The runtime callbacks enforce tool and time limits and record usage; the child process code invokes Wrangler with shell execution disabled.
- The alleged browser credential collection code is a log-redaction helper, and login password verification is rate limited.
- The remaining required paths inspected are dashboard assets, API declarations, YAML parsing code, and the declared helper dependencies; they establish no attack behavior.
Evidence against
- The source does not support the scanner’s claim that a prompted Anthropic key is redirected to the TypeSafe endpoint: provider configuration keeps that key under Claude, while the TypeSafe request uses a separate key.
- The browser credential alert points to code that redacts secrets in logs, not code that collects browser login credentials.
Source & flagged code
9 flaggeddist/traffic-J3SSIDXQ.jsView file
43// src/cloudflare-worker-deploy.ts
L44: import { spawn } from "child_process";
L45: import { randomUUID } from "crypto";
High
Child Process
Package source references child process execution.
dist/traffic-J3SSIDXQ.jsView on unpkg · L43dist/chunk-ATXHIX32.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @canonry/canonry@7.64.2
matchedIdentity = npm:QGNhbm9ucnkvY2Fub25yeQ:7.64.2
similarity = 0.983
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-ATXHIX32.jsView on unpkg•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/chunk-ATXHIX32.js:
oauthAuthorizationCodes,
throw forbidden(`This action requires the "${scope}" scope on your API key.`);
var NARROW_KEY_DENIED_MESSAGE = "This API key is narrower than the install, so it cannot use an administrator surface.";
throw forbidden("Internal diagnostics require a host-approved operator API key. Customer accounts and scopes cannot grant operator access.");
function requirePaidReadScope(request, allowedScopes = [ADS_WRITE_SCOPE, ADS_APPROVE_SCOPE, ADS_ACTIVATE_SCOPE], denialMessage = "This API key was not granted access to OpenAI Ads ...
throw forbidden("This API key is limited to one project, and this is
Findings
4 Critical5 High3 Medium5 Low
CriticalBrowser Credential Phishingdist/chunk-YVYID65D.js
CriticalTrojan Source Unicodeassets/assets/vendor-yaml-Y43rmNgW.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-YVYID65D.js
CriticalPrevious Version Dangerous Deltadist/chunk-ATXHIX32.js
HighChild Processdist/traffic-J3SSIDXQ.js
HighCredential Redirect Persistencedist/chunk-ATXHIX32.js
HighCommand Output Exfiltrationdist/chunk-ATXHIX32.js
HighCross File Remote Execution Contextdist/chunk-PG6Q6MEF.js
HighSemantic Analysis Limiteddist/chunk-ATXHIX32.js
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @canonry/canonry@7.64.4.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.64.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.