registry / @canonry/canonry / 7.87.1
@canonry/canonry@7.87.1
Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged behaviors are consistent with the package’s provider integrations, Wrangler operations, disclosed opt-out telemetry, and synchronization of its own previously installed skills. The manifest has no install lifecycle hook, and no unauthorized credential flow or other attack behavior was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Provider requests occur during application operations using configured credentials; CLI telemetry runs when enabled.
Impact
No unauthorized credential transfer, account action, destructive behavior, or concealed code execution was identified.
Mechanism
Requests target the named provider services or Canonry’s telemetry endpoint. The reviewed TypeSafe request rejects redirects, and skill synchronization is limited to previously installed Canonry skills.
AI rationale
The flagged behaviors are consistent with the package’s provider integrations, Wrangler operations, disclosed opt-out telemetry, and synchronization of its own previously installed skills. The manifest has no install lifecycle hook, and no unauthorized credential flow or other attack behavior was found.
Evidence
~/.canonry/config.yaml.claude/skills/canonry.codex/skills/canonry
Network endpoints3
api.typesafe.aiopenrouter.aicanonry.ai
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes CLI binaries and an ESM entry point; its scripts are build, typecheck, test, and lint, with no install lifecycle hook.
- Configured TypeSafe credentials are sent to api.typesafe.ai, and the request rejects redirects.
- The sentiment classifier uses the official openrouter.ai host.
- CLI telemetry is described as anonymous, has a documented disable command, and sending checks the telemetry preference.
- Skill synchronization is tied to previously installed Canonry skills and can be disabled with CANONRY_NO_AUTO_SKILLS_SYNC.
Evidence against
- No default credential collection or unrelated credential destination was identified in the reviewed flows.
- The flagged child process helper invokes a named command with shell disabled for Wrangler operations.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStrings
Source & flagged code
8 flaggeddist/traffic-B7Q4WPOV.jsView file
44// src/cloudflare-worker-deploy.ts
L45: import { spawn } from "child_process";
L46: import { randomUUID } from "crypto";
High
Child Process
Package source references child process execution.
dist/traffic-B7Q4WPOV.jsView on unpkg · L44dist/chunk-BKZ6PQAE.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/chunk-BKZ6PQAE.js:
let sanitized = value.replace(/(authorization\s*:\s*bearer\s+)[^\s,"'}]+/gi, "$1***").replace(/((?:developer|access)[_-]?token\s*[:=]\s*["']?)[^\s,"'}]+/gi, "$1***");
Authorization: `Bearer ${this.#accessToken}`,
authorization: `Bearer ${accessToken}`,
Authorization: `Basic ${Buffer.from(`${credentials.login}:${credentials.password}`).toString("base64")}`,
headers: { authorization: `Bearer ${options.apiKey}`, "content-type": "application/json" },
const code = response.status === 401 || response.status === 403 ? "provider-authorization" : response.status === 413 ? "provider-context-limit" : response.status === 42
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
3 Critical5 High3 Medium5 Low
CriticalBrowser Credential Phishingdist/chunk-F643WELJ.js
CriticalTrojan Source Unicodeassets/assets/vendor-yaml-Y43rmNgW.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-F643WELJ.js
HighChild Processdist/traffic-B7Q4WPOV.js
HighCredential Redirect Persistencedist/chunk-BKZ6PQAE.js
HighCommand Output Exfiltrationdist/chunk-W7DHXSXN.js
HighCross File Remote Execution Contextdist/chunk-UXSWQAVZ.js
HighSemantic Analysis Limiteddist/chunk-W7DHXSXN.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to @canonry/canonry@7.87.1.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.87.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.