@rallycry/conveyor-agent@10.13.18: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@rallycry/conveyor-agent@10.13.18: Suspicious npm security report | LPM Firewall

Source & flagged code

4 flagged · loading source

dist/boot-YZCOIV3Q.jsView file

23// src/boot/index.ts L24: import { spawn } from "child_process"; L25: import { statSync as statSync3 } from "fs"; ... L52: function parseBundle(text) { L53: const raw = JSON.parse(text); L54: const envVarsRaw = raw.envVars; ... L164: const emit = (line) => { L165: process.stdout.write(`${line} L166: `); ... L271: var NPM_CACHE_DIR = "/tmp/npm-cache"; L272: var NPM_REGISTRY_ARG = "--@rallycry:registry=https://registry.npmjs.org/"; L273: var SEMVER_RE = /^\d+\.\d+\.\d+([-+][A-Za-z0-9.-]+)?$/;

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/boot-YZCOIV3Q.jsView on unpkg · L23

23Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/boot-YZCOIV3Q.js L23: // src/boot/index.ts L24: import { spawn } from "child_process"; L25: import { statSync as statSync3 } from "fs"; ... L52: function parseBundle(text) { L53: const raw = JSON.parse(text); L54: const envVarsRaw = raw.envVars; ... L164: const emit = (line) => { L165: process.stdout.write(`${line} L166: `); ... L271: var NPM_CACHE_DIR = "/tmp/npm-cache"; L272: var NPM_REGISTRY_ARG = "--@rallycry:registry=https://registry.npmjs.org/"; L273: var SEMVER_RE = /^\d+\.\d+\.\d+([-+][A-Za-z0-9.-]+)?$/;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/boot-YZCOIV3Q.jsView on unpkg · L23

•matchType = previous_version_dangerous_delta matchedPackage = @rallycry/conveyor-agent@10.13.13 matchedIdentity = npm:[redacted]:10.13.13 similarity = 0.538 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/boot-YZCOIV3Q.jsView on unpkg

runtime/entrypoint.shView file

•path = runtime/entrypoint.sh kind = build_helper sizeBytes = 521 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/entrypoint.shView on unpkg

Source & flagged code

4 flagged

dist/boot-YZCOIV3Q.jsView file

Lines 3-43javascript

3 isLegacyEntrypointLaunch

4} from "./chunk-6GS5ADIY.js";

5import {

6 GitPrepJob,

7 defaultGit,

8 ensureDir,

9 readAgentVersion,

10 redactToken

11} from "./chunk-UZTJJD7Y.js";

12import {

13 workbenchPort

14} from "./chunk-4VUQ2NPF.js";

15import {

16 startWorkbenchServer

17} from "./chunk-AGGVNADW.js";

18import "./chunk-72AEN6LB.js";

19import {

20 DEFAULT_WORKBENCH_PORT

21} from "./chunk-JIGG755T.js";

22

23// src/boot/index.ts

24import { spawn } from "child_process";

25import { statSync as statSync3 } from "fs";

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/boot-YZCOIV3Q.jsView on unpkg · L23

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/boot-YZCOIV3Q.jsView on unpkg · L23

26import { hostname as osHostname } from "os";

27

28// src/boot/bundle.ts

29function requireString(source, field) {

30 const value = source[field];

31 if (typeof value !== "string") {

32 throw new Error(`bundle missing field: ${field}`);

33 }

34 return value;

35}

36function parseGitPlan(raw) {

37 if (typeof raw !== "object" || raw === null) {

38 throw new Error("bundle missing field: gitPlan");

39 }

40 const obj = raw;

41 const plan = {

42 repoOwner: requireString(obj, "repoOwner"),

43 repoName: requireString(obj, "repoName"),

•matchType = previous_version_dangerous_delta matchedPackage = @rallycry/conveyor-agent@10.13.13 matchedIdentity = npm:[redacted]:10.13.13 similarity = 0.538 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/boot-YZCOIV3Q.jsView on unpkg

runtime/entrypoint.shView file

•path = runtime/entrypoint.sh kind = build_helper sizeBytes = 521 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/entrypoint.shView on unpkg