Loading npm security reports…

@rallycry/conveyor-agent: Malicious npm security report (Block) | LPM Firewall

registry / @rallycry/conveyor-agent / 11.0.11

@rallycry/conveyor-agent@11.0.11

Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Running the package's boot entrypoint automatically installs persisted SSH keys and exposes sshd on every network interface. An authorized key from the shared workbench location can obtain a shell as the conveyor user.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Executing runtime/entrypoint.sh or conveyor-agent boot in a workbench container.

Impact

Remote command execution and persistent access to the workbench container.

Mechanism

Automatic persisted-key SSH service exposed on all interfaces.

Attack narrative

The supplied runtime entrypoint invokes the boot command. In workbench mode, boot copies SSH authorization material from a shared location into /home/conveyor/.ssh/authorized_keys, then launches sshd with sudo on 0.0.0.0 and a configurable port that defaults to 2222. This creates an automatic, externally reachable remote shell path backed by persisted keys.

Rationale

The package contains a reachable boot path that automatically establishes persisted SSH-key access and listens on all interfaces. Although this is not an npm install hook, it is a concrete remote-access and persistence capability.

Evidence

runtime/entrypoint.shdist/cli.jsdist/boot-ZE6BM7L2.js/var/run/conveyor-workbench/ssh/authorized_keys/home/conveyor/.ssh/authorized_keys

Network endpoints1

0.0.0.0:2222

Decision evidence

Source & flagged code

8 flagged · loading source

dist/chunk-PGNV3DGV.jsView file

136try { L137: parsed = JSON.parse(payloadJson); L138: } catch { ... L552: // ── Environment setup / start command ───────────────────────────────── L553: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L554: z3.object({ ... L2202: "xpack.profiling.enabled": "false", L2203: "ingest.geoip.downloader.enabled": "false", L2204: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2217: connectionEnv: { L2218: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2219: },

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-PGNV3DGV.jsView on unpkg · L136

136Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-PGNV3DGV.js L136: try { L137: parsed = JSON.parse(payloadJson); L138: } catch { ... L552: // ── Environment setup / start command ───────────────────────────────── L553: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L554: z3.object({ ... L2202: "xpack.profiling.enabled": "false", L2203: "ingest.geoip.downloader.enabled": "false", L2204: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2217: connectionEnv: { L2218: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2219: },

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-PGNV3DGV.jsView on unpkg · L136

136Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/chunk-PGNV3DGV.js L136: try { L137: parsed = JSON.parse(payloadJson); L138: } catch { ... L552: // ── Environment setup / start command ───────────────────────────────── L553: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L554: z3.object({ ... L2202: "xpack.profiling.enabled": "false", L2203: "ingest.geoip.downloader.enabled": "false", L2204: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2217: connectionEnv: { L2218: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2219: },

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/chunk-PGNV3DGV.jsView on unpkg · L136

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-PGNV3DGV.jsView on unpkg

dist/boot-ZE6BM7L2.jsView file

33// src/boot/index.ts L34: import { spawn } from "child_process"; L35: import { statSync as statSync3 } from "fs"; ... L55: provider, L56: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`, L57: repoOwner, ... L67: function parseBundle(text) { L68: const raw = JSON.parse(text); L69: const envVarsRaw = raw.envVars; ... L169: const emit = (line) => { L170: process.stdout.write(`${line} L171: `);

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/boot-ZE6BM7L2.jsView on unpkg · L33

•matchType = previous_version_dangerous_delta matchedPackage = @rallycry/conveyor-agent@10.13.59 matchedIdentity = npm:[redacted]:10.13.59 similarity = 0.550 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/boot-ZE6BM7L2.jsView on unpkg

33Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/boot-ZE6BM7L2.js L33: // src/boot/index.ts L34: import { spawn } from "child_process"; L35: import { statSync as statSync3 } from "fs"; ... L55: provider, L56: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`, L57: repoOwner, ... L67: function parseBundle(text) { L68: const raw = JSON.parse(text); L69: const envVarsRaw = raw.envVars; ... L169: const emit = (line) => { L170: process.stdout.write(`${line} L171: `);

runtime/entrypoint.shView file

•path = runtime/entrypoint.sh kind = build_helper sizeBytes = 603 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/entrypoint.shView on unpkg

Source & flagged code

8 flagged

dist/chunk-PGNV3DGV.jsView file

136try { L137: parsed = JSON.parse(payloadJson); L138: } catch { ... L552: // ── Environment setup / start command ───────────────────────────────── L553: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L554: z3.object({ ... L2202: "xpack.profiling.enabled": "false", L2203: "ingest.geoip.downloader.enabled": "false", L2204: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2217: connectionEnv: { L2218: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2219: },

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-PGNV3DGV.jsView on unpkg · L136

136Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-PGNV3DGV.js L136: try { L137: parsed = JSON.parse(payloadJson); L138: } catch { ... L552: // ── Environment setup / start command ───────────────────────────────── L553: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L554: z3.object({ ... L2202: "xpack.profiling.enabled": "false", L2203: "ingest.geoip.downloader.enabled": "false", L2204: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2217: connectionEnv: { L2218: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2219: },

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-PGNV3DGV.jsView on unpkg · L136

136Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/chunk-PGNV3DGV.js L136: try { L137: parsed = JSON.parse(payloadJson); L138: } catch { ... L552: // ── Environment setup / start command ───────────────────────────────── L553: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L554: z3.object({ ... L2202: "xpack.profiling.enabled": "false", L2203: "ingest.geoip.downloader.enabled": "false", L2204: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2217: connectionEnv: { L2218: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2219: },

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/chunk-PGNV3DGV.jsView on unpkg · L136

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-PGNV3DGV.jsView on unpkg

dist/boot-ZE6BM7L2.jsView file

Lines 13-53javascript

13 runPreReadyBinds

14} from "./chunk-SR66HQKB.js";

15import "./chunk-JG3VMWRQ.js";

16import {

17 GitPrepJob,

18 defaultGit,

19 ensureDir,

20 reportBootMilestone

21} from

runtime/entrypoint.shView file

•path = runtime/entrypoint.sh kind = build_helper sizeBytes = 603 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/entrypoint.shView on unpkg