registry / @canonry/canonry / 7.90.0

@canonry/canonry@7.90.0

⚠ Under review

Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 17 low-signal pattern(s) were surfaced and cleared.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 154 file(s), 12.8 MB of source, external domains: 127.0.0.1, accounts.google.com, agent-plugins.org, ai.google.dev, aistudio.google.com, analyticsadmin.googleapis.com, analyticsdata.googleapis.com, api.ads.openai.com, api.cloudflare.com, api.dataforseo.com, api.exa.ai, api.meta.ai, api.parallel.ai, api.perplexity.ai, api.typesafe.ai, bit.ly, businessprofileperformance.googleapis.com, canonry.ai, canonry.example.invalid, canonry.invalid, canonry.local, claude.com, commoncrawl.org, competitor.example, console.cloud.google.com, console.developers.google.com, dash.cloudflare.com, dashboard.exa.ai, data.commoncrawl.org, dev.meta.ai, developer.amazon.com, developers.google.com, developers.openai.com, discord.gg, docs.parallel.ai, duckduckgo.com, exa.ai, example.com, github.com, googleads.googleapis.com, help.openai.com, home-buyer-checklist.example, home-cost-report.example, home-services-reviews.example, homeowner-guides.example, hooks.example.com, index.commoncrawl.org, indexing.googleapis.com, json-schema.org, local-contractor-directory.example

Source & flagged code

9 flagged

dist/chunk-C2XWWIJZ.jsView file

6849// src/commands/daemon.ts L6850: import { spawn } from "child_process"; L6851: import fs from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-C2XWWIJZ.jsView on unpkg · L6849

395Cross-file remote execution chain: dist/chunk-C2XWWIJZ.js spawns dist/chunk-ETIIPSWL.js; helper contains network access plus dynamic code execution. L395: try { L396: value = JSON.parse(readFileSync(source === "-" ? 0 : source, "utf8")); L397: } catch { ... L417: if (printSeoJson(value, format)) return; L418: console.log(`SEO data: ${value.available ? "available" : "unavailable"}`); L419: if (value.reason) console.log(value.reason); ... L653: access: "stored", L654: help: "Host operator only. Read private upstream receipts and cost for reconciliation.", L655: run: (input) => showSeoOperatorTask(requirePositional(input, 0, { command: "seo.operator.task", usage: "canonry seo operator task <task-id>", message: "task ID is required" }), inp... ... L3343: message: `Unknown --from value "${opts.

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-C2XWWIJZ.jsView on unpkg · L395

Findings

4 Critical5 High3 Medium5 Low

CriticalBrowser Credential Phishingdist/chunk-ETIIPSWL.js

CriticalTrojan Source Unicodeassets/assets/vendor-yaml-Y43rmNgW.js

CriticalTrigger Reachable Dangerous Capabilitydist/chunk-ETIIPSWL.js

CriticalPrevious Version Dangerous Deltadist/chunk-SDXMG4VX.js

HighChild Processdist/chunk-C2XWWIJZ.js

HighCredential Redirect Persistencedist/chunk-OVUFIG22.js

HighCommand Output Exfiltrationdist/chunk-SDXMG4VX.js

HighCross File Remote Execution Contextdist/chunk-C2XWWIJZ.js

HighSemantic Analysis Limiteddist/chunk-SDXMG4VX.js

MediumNetwork

MediumEnvironment Vars

Medium

Affected versions and remediation

This report applies to @canonry/canonry@7.90.0.

See all versions of @canonry/canonry for other recorded verdicts.

Review the evidence and your use of @canonry/canonry@7.90.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-04 16:41:58.278Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @canonry/canonry / 7.90.0

@canonry/canonry@7.90.0

⚠ Under review

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 17 low-signal pattern(s) were surfaced and cleared.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

9 flagged

dist/chunk-C2XWWIJZ.jsView file

6849// src/commands/daemon.ts L6850: import { spawn } from "child_process"; L6851: import fs from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-C2XWWIJZ.jsView on unpkg · L6849

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-C2XWWIJZ.jsView on unpkg · L395

Findings

4 Critical5 High3 Medium5 Low

CriticalBrowser Credential Phishingdist/chunk-ETIIPSWL.js

CriticalTrojan Source Unicodeassets/assets/vendor-yaml-Y43rmNgW.js

CriticalTrigger Reachable Dangerous Capabilitydist/chunk-ETIIPSWL.js

CriticalPrevious Version Dangerous Deltadist/chunk-SDXMG4VX.js

HighChild Processdist/chunk-C2XWWIJZ.js

HighCredential Redirect Persistencedist/chunk-OVUFIG22.js

HighCommand Output Exfiltrationdist/chunk-SDXMG4VX.js

HighCross File Remote Execution Contextdist/chunk-C2XWWIJZ.js

HighSemantic Analysis Limiteddist/chunk-SDXMG4VX.js

MediumNetwork

MediumEnvironment Vars

Medium

Affected versions and remediation

This report applies to @canonry/canonry@7.90.0.

See all versions of @canonry/canonry for other recorded verdicts.

Review the evidence and your use of @canonry/canonry@7.90.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-04 16:41:58.278Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.