@canonry/canonry@7.73.0
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe CLI sends default-on telemetry to Canonry, including command and setup details with a persistent ID derived from hostname and MAC address. Although the package offers a disable command and sometimes shows a notice, it skips that notice when no config exists even though telemetry remains enabled, making this undisclosed runtime telemetry suspicious.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Run an ordinary CLI command while telemetry is enabled, including before a config exists.
Impact
The publisher receives command usage and setup information linked to a stable identifier derived from the host; no credential exfiltration was identified.
Mechanism
The CLI posts command and runtime event data plus persistent pseudonymous IDs to Canonry’s telemetry endpoint.
AI rationale
The CLI sends default-on telemetry to Canonry, including command and setup details with a persistent ID derived from hostname and MAC address. Although the package offers a disable command and sometimes shows a notice, it skips that notice when no config exists even though telemetry remains enabled, making this undisclosed runtime telemetry suspicious.
Evidence
dist/cli.jsdist/chunk-PRSQ4R47.js~/.canonry/machine-id
Network endpoints1
canonry.ai
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Ordinary CLI commands track telemetry by default when telemetry is enabled; with no config, telemetry is enabled.
- Finished-command events include the command name, success, duration bucket and setup state.
- Telemetry is sent to Canonry and includes anonymous and machine IDs; the machine ID can be derived from the hostname and MAC address.
- The disclosure notice is shown only when a config exists and has no anonymous ID. With no config, that notice is skipped while telemetry remains enabled.
Evidence against
- The telemetry goes to the package publisher’s own Canonry endpoint, not an unrelated collector.
- The package provides a telemetry disable command and a first-run notice in some configuration states.
- The manifest declares no lifecycle scripts, and the reviewed telemetry flow does not show credential collection or transmission.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
9 flaggeddist/chunk-3ANSG6YT.jsView file
6553// src/commands/daemon.ts
L6554: import { spawn } from "child_process";
L6555: import fs from "fs";
High
Child Process
Package source references child process execution.
dist/chunk-3ANSG6YT.jsView on unpkg · L6553392Cross-file remote execution chain: dist/chunk-3ANSG6YT.js spawns dist/chunk-SF5JLMLG.js; helper contains network access plus dynamic code execution.
L392: try {
L393: value = JSON.parse(readFileSync(source === "-" ? 0 : source, "utf8"));
L394: } catch {
...
L414: if (printSeoJson(value, format)) return;
L415: console.log(`SEO data: ${value.available ? "available" : "unavailable"}`);
L416: if (value.reason) console.log(value.reason);
...
L623: access: "stored",
L624: help: "Host operator only. Read private upstream receipts and cost for reconciliation.",
L625: run: (input) => showSeoOperatorTask(requirePositional(input, 0, { command: "seo.operator.task", usage: "canonry seo operator task <task-id>", message: "task ID is required" }), inp...
...
L3109: message: `Unknown --from value "${opts.
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/chunk-3ANSG6YT.jsView on unpkg · L392Findings
4 Critical5 High3 Medium5 Low
CriticalBrowser Credential Phishingdist/chunk-SF5JLMLG.js
CriticalTrojan Source Unicodeassets/assets/vendor-yaml-Y43rmNgW.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-SF5JLMLG.js
CriticalPrevious Version Dangerous Deltadist/chunk-WLWOGBLJ.js
HighChild Processdist/chunk-3ANSG6YT.js
HighCredential Redirect Persistencedist/chunk-HIGBV77K.js
HighCommand Output Exfiltrationdist/chunk-WLWOGBLJ.js
HighCross File Remote Execution Contextdist/chunk-3ANSG6YT.js
HighSemantic Analysis Limiteddist/chunk-WLWOGBLJ.js
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @canonry/canonry@7.73.0.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.73.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.