registry / Persistence / @rallycry/conveyor-agent
@rallycry/conveyor-agent
Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.
This report shows the evidence for @rallycry/conveyor-agent@11.0.11. 1 of 83 known versions is blocked or flagged. The newest version, 11.1.5, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains a reachable boot path that automatically establishes persisted SSH-key access and listens on all interfaces. Although this is not an npm install hook, it is a concrete remote-access and persistence capability.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Executing runtime/entrypoint.sh or conveyor-agent boot in a workbench container.
Impact
Remote command execution and persistent access to the workbench container.
Mechanism
Automatic persisted-key SSH service exposed on all interfaces.
Attack narrative
The supplied runtime entrypoint invokes the boot command. In workbench mode, boot copies SSH authorization material from a shared location into /home/conveyor/.ssh/authorized_keys, then launches sshd with sudo on 0.0.0.0 and a configurable port that defaults to 2222. This creates an automatic, externally reachable remote shell path backed by persisted keys.
AI rationale
The package contains a reachable boot path that automatically establishes persisted SSH-key access and listens on all interfaces. Although this is not an npm install hook, it is a concrete remote-access and persistence capability.
Evidence
runtime/entrypoint.shdist/cli.jsdist/boot-ZE6BM7L2.js/var/run/conveyor-workbench/ssh/authorized_keys/home/conveyor/.ssh/authorized_keys
Network endpoints1
0.0.0.0:2222
Decision evidence
public snapshotAI called this Malicious at 93.0% confidence as Malware with low false-positive risk.
Evidence for block
- The boot command imports and executes the boot module.
- Workbench boot automatically copies a persisted SSH authorized-keys file into the service account home.
- The boot path starts sshd on all interfaces with sudo, creating remote shell access.
Evidence against
- package.json has no npm install lifecycle hook; its only lifecycle script is prepublishOnly.
- The SSH boot path requires the package-specific workbench role and bootstrap environment variables.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
8 flagged · loading sourcedist/chunk-PGNV3DGV.jsView file
136try {
L137: parsed = JSON.parse(payloadJson);
L138: } catch {
...
L552: // ── Environment setup / start command ─────────────────────────────────
L553: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(),
L554: z3.object({
...
L2202: "xpack.profiling.enabled": "false",
L2203: "ingest.geoip.downloader.enabled": "false",
L2204: ES_JAVA_OPTS: "-Xms512m -Xmx512m"
...
L2217: connectionEnv: {
L2218: ELASTICSEARCH_URL: "http://elasticsearch:9200"
L2219: },
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunk-PGNV3DGV.jsView on unpkg · L136136Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-PGNV3DGV.js
L136: try {
L137: parsed = JSON.parse(payloadJson);
L138: } catch {
...
L552: // ── Environment setup / start command ─────────────────────────────────
L553: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(),
L554: z3.object({
...
L2202: "xpack.profiling.enabled": "false",
L2203: "ingest.geoip.downloader.enabled": "false",
L2204: ES_JAVA_OPTS: "-Xms512m -Xmx512m"
...
L2217: connectionEnv: {
L2218: ELASTICSEARCH_URL: "http://elasticsearch:9200"
L2219: },
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/chunk-PGNV3DGV.jsView on unpkg · L136Findings
4 Critical3 High4 Medium5 Low
CriticalCredential Exfiltrationdist/chunk-PGNV3DGV.js
CriticalPersistence Backdoordist/boot-ZE6BM7L2.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-PGNV3DGV.js
CriticalPrevious Version Dangerous Deltadist/boot-ZE6BM7L2.js
HighTrigger Reachable Credential Exfiltrationdist/chunk-PGNV3DGV.js
HighTrigger Reachable Persistencedist/boot-ZE6BM7L2.js
HighSemantic Analysis Limiteddist/chunk-PGNV3DGV.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperruntime/entrypoint.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @rallycry/conveyor-agent@11.0.11.
The versions list below shows the verdict for each recorded version.
- Avoid installing @rallycry/conveyor-agent@11.0.11. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.