registry / @canonry/canonry / 7.85.0
@canonry/canonry@7.85.0
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged credential and process patterns resolve to normal provider calls and a local Node.js server-launch helper. Runtime telemetry is disclosed, sent to Canonry’s own endpoint, and can be disabled; the manifest has no install lifecycle hook.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
CLI commands may send telemetry; provider requests occur when the configured AI provider is used.
Impact
No unrelated credential collection, hidden install-time activity or unrequested account action was established.
Mechanism
Telemetry goes to Canonry’s endpoint after checking the opt-out setting. Provider credentials are sent as bearer tokens to the configured provider base URL, with OpenRouter’s official endpoint as its default.
AI rationale
The flagged credential and process patterns resolve to normal provider calls and a local Node.js server-launch helper. Runtime telemetry is disclosed, sent to Canonry’s own endpoint, and can be disabled; the manifest has no install lifecycle hook.
Network endpoints2
canonry.ai/api/telemetryopenrouter.ai/api/v1
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and library entry point; its npm scripts are build, typecheck, test and lint scripts, with no install lifecycle hook.
- The CLI displays a notice identifying telemetry as anonymous and gives `canonry telemetry disable` as an opt-out.
- Telemetry checks the opt-out preference before sending generated anonymous and session IDs with event metadata to Canonry’s own endpoint.
- OpenRouter requests use its official API base URL by default and send the configured API key to the selected base URL.
Evidence against
- Telemetry is enabled by default when no config exists and sends persistent pseudonymous identifiers to the package vendor.
- The CLI can automatically sync the package’s own skills during a user-invoked command. These actions fit the package’s documented purpose and do not establish an attack.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
9 flaggeddist/chunk-C2H5TPKD.jsView file
6645// src/commands/daemon.ts
L6646: import { spawn } from "child_process";
L6647: import fs from "fs";
High
Child Process
Package source references child process execution.
dist/chunk-C2H5TPKD.jsView on unpkg · L6645394Cross-file remote execution chain: dist/chunk-C2H5TPKD.js spawns dist/chunk-KNKOTLVW.js; helper contains network access plus dynamic code execution.
L394: try {
L395: value = JSON.parse(readFileSync(source === "-" ? 0 : source, "utf8"));
L396: } catch {
...
L416: if (printSeoJson(value, format)) return;
L417: console.log(`SEO data: ${value.available ? "available" : "unavailable"}`);
L418: if (value.reason) console.log(value.reason);
...
L652: access: "stored",
L653: help: "Host operator only. Read private upstream receipts and cost for reconciliation.",
L654: run: (input) => showSeoOperatorTask(requirePositional(input, 0, { command: "seo.operator.task", usage: "canonry seo operator task <task-id>", message: "task ID is required" }), inp...
...
L3140: message: `Unknown --from value "${opts.
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/chunk-C2H5TPKD.jsView on unpkg · L394Findings
4 Critical5 High3 Medium5 Low
CriticalBrowser Credential Phishingdist/chunk-KNKOTLVW.js
CriticalTrojan Source Unicodeassets/assets/vendor-yaml-Y43rmNgW.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-KNKOTLVW.js
CriticalPrevious Version Dangerous Deltadist/chunk-JVO5GQZH.js
HighChild Processdist/chunk-C2H5TPKD.js
HighCredential Redirect Persistencedist/chunk-JVO5GQZH.js
HighCommand Output Exfiltrationdist/chunk-JVO5GQZH.js
HighCross File Remote Execution Contextdist/chunk-C2H5TPKD.js
HighSemantic Analysis Limiteddist/chunk-JVO5GQZH.js
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @canonry/canonry@7.85.0.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.85.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.