registry / @canonry/canonry / 7.66.0
@canonry/canonry@7.66.0
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe manifest has no npm install hook, and source inspection resolved the flagged behaviors to explicit setup actions, configured provider requests, local usage recording, and ordinary login/schema code. I found no concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
No install-time trigger was present; the relevant setup routines run through explicit CLI commands or application actions.
Impact
No unauthorized credential transfer, account action, persistence, or broad configuration mutation was established.
Mechanism
Inspected provider requests use configured credentials and fixed endpoints, while agent usage events are recorded in a supplied local database.
AI rationale
The manifest has no npm install hook, and source inspection resolved the flagged behaviors to explicit setup actions, configured provider requests, local usage recording, and ordinary login/schema code. I found no concrete malicious behavior.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- package.json has CLI entrypoints and build scripts but no npm install lifecycle hook.
- Agent skills are written from a registered CLI command into scoped skill directories, with local edits preserved unless force is requested.
- The optional data plugin installer runs through an application install callback and installs into its plugin directory.
- Agent runtime listeners enforce tool-call limits and record assistant usage in the supplied local database.
- Sentiment requests use configured provider credentials and fixed provider endpoints; the OpenRouter transport rejects other destinations.
- The password occurrence is a product login schema; other flagged paths are UI bundles, declarations, traffic integration, a YAML parser, or ordinary dependencies.
Evidence against
- Scanner descriptions of browser credential theft, persistent credential redirection, and Trojan Source behavior were not supported by the inspected source.
- The child process installs an optional plugin into its plugin directory through an application callback; it is not an npm lifecycle action.
Behavioral surface
Source & flagged code
9 flaggeddist/chunk-JYOMHNRP.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @canonry/canonry@7.65.0
matchedIdentity = npm:QGNhbm9ucnkvY2Fub25yeQ:7.65.0
similarity = 0.917
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-JYOMHNRP.jsView on unpkg60181// ../integration-commoncrawl/src/plugin-installer.ts
L60182: import { spawn } from "child_process";
L60183: import fs4 from "fs/promises";
High
Child Process
Package source references child process execution.
dist/chunk-JYOMHNRP.jsView on unpkg · L601811196});
L1197: return `${PREFIX}${salt.toString("base64")}$${derived.toString("base64")}`;
L1198: }
...
L1503: });
L1504: app.post("/auth/login", async (request, reply) => {
L1505: const parsed = loginRequestSchema.safeParse(request.body);
...
L4964: try {
L4965: const parsed = new URL(/^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`);
L4966: return parsed.hostname.toLowerCase().replace(/\.$/, "") || null;
...
L6697: if (first === 10 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168) {
L6698: return "which is private space";
L6699: }
Findings
4 Critical5 High3 Medium5 Low
CriticalBrowser Credential Phishingdist/chunk-WNCOBSPN.js
CriticalTrojan Source Unicodeassets/assets/vendor-yaml-Y43rmNgW.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-WNCOBSPN.js
CriticalPrevious Version Dangerous Deltadist/chunk-JYOMHNRP.js
HighChild Processdist/chunk-JYOMHNRP.js
HighCredential Redirect Persistencedist/chunk-AVQQRTMD.js
HighCommand Output Exfiltrationdist/chunk-JYOMHNRP.js
HighCross File Remote Execution Contextdist/chunk-ZRSNMEB3.js
HighSemantic Analysis Limiteddist/chunk-JYOMHNRP.js
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @canonry/canonry@7.66.0.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.66.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.