registry / @canonry/canonry / 7.67.0
@canonry/canonry@7.67.0
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 10d ago · by lpm-firewall-aiSource inspection resolved the flagged credential transfers to configured or service-specific endpoints and the agent integration to explicit local skill setup. The package manifest has no install lifecycle hook, and the inspected scanner matches do not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Package installation has no lifecycle hook; skill setup runs through the explicit skills install command.
Impact
The reviewed behavior supports configured integrations and local setup; no credential theft or stealth agent mutation was established.
Mechanism
Inspected provider requests use configured credentials and destinations; skill setup reconciles bundled local files and a local symlink.
AI rationale
Source inspection resolved the flagged credential transfers to configured or service-specific endpoints and the agent integration to explicit local skill setup. The package manifest has no install lifecycle hook, and the inspected scanner matches do not establish malicious behavior.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the CLI and runtime library; its scripts are build, typecheck, test, and lint, with no install lifecycle hook.
- Agent skill files are reconciled only through the explicit skills install command; the server path checks for missing files and prints a suggestion.
- The inspected provider requests send configured API keys to the configured provider URL; the OpenRouter default is its own service, and the proxy helper uses caller-supplied URL and token.
- The inspected Vercel integration sends a supplied token to Vercel's request-logs endpoint with caller-supplied project and team identifiers.
- The other required paths contain application imports, UI/query libraries, YAML parsing, and ordinary Fastify and agent dependencies; the secret-related match is a diagnostic redaction rule.
Evidence against
- The flagged credential transfers resolve to configured or service-specific destinations in the inspected source.
- The agent-related file writes install bundled local reference skills and link them for Codex; no automatic install-time agent configuration change was found.
- The inspected password and secret pattern is used for diagnostic redaction, not browser credential collection.
Source & flagged code
9 flaggeddist/chunk-AVISYPUU.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @canonry/canonry@7.66.0
matchedIdentity = npm:QGNhbm9ucnkvY2Fub25yeQ:7.66.0
similarity = 0.925
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-AVISYPUU.jsView on unpkg60227// ../integration-commoncrawl/src/plugin-installer.ts
L60228: import { spawn } from "child_process";
L60229: import fs4 from "fs/promises";
High
Child Process
Package source references child process execution.
dist/chunk-AVISYPUU.jsView on unpkg · L60227•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/chunk-AVISYPUU.js:
oauthAuthorizationCodes,
throw forbidden(`This action requires the "${scope}" scope on your API key.`);
var NARROW_KEY_DENIED_MESSAGE = "This API key is narrower than the install, so it cannot use an administrator surface.";
throw forbidden("Internal diagnostics require a host-approved operator API key. Customer accounts and scopes cannot grant operator access.");
function requirePaidReadScope(request, allowedScopes = [ADS_WRITE_SCOPE, ADS_APPROVE_SCOPE, ADS_ACTIVATE_SCOPE], denialMessage = "This API key was not granted access to OpenAI Ads ...
throw forbidden("This API key is limited to one project, and this is
Findings
4 Critical5 High3 Medium5 Low
CriticalBrowser Credential Phishingdist/chunk-XEGYSZEV.js
CriticalTrojan Source Unicodeassets/assets/vendor-yaml-Y43rmNgW.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-XEGYSZEV.js
CriticalPrevious Version Dangerous Deltadist/chunk-AVISYPUU.js
HighChild Processdist/chunk-AVISYPUU.js
HighCredential Redirect Persistencedist/chunk-AVISYPUU.js
HighCommand Output Exfiltrationdist/chunk-AVISYPUU.js
HighCross File Remote Execution Contextdist/chunk-AFRCTLUL.js
HighSemantic Analysis Limiteddist/chunk-AVISYPUU.js
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @canonry/canonry@7.67.0.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.67.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.