@rallycry/conveyor-agent@10.13.50: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@rallycry/conveyor-agent@10.13.50: Suspicious npm security report | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/boot-I353EAK6.jsView file

27// src/boot/index.ts L28: import { spawn } from "child_process"; L29: import { statSync as statSync4 } from "fs"; ... L56: function parseBundle(text) { L57: const raw = JSON.parse(text); L58: const envVarsRaw = raw.envVars; ... L168: const emit = (line) => { L169: process.stdout.write(`${line} L170: `); ... L677: return join3( L678: process.env.CONVEYOR_SHARED_DIR || "/var/run/conveyor-workbench", L679: "ssh",

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/boot-I353EAK6.jsView on unpkg · L27

27Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/boot-I353EAK6.js L27: // src/boot/index.ts L28: import { spawn } from "child_process"; L29: import { statSync as statSync4 } from "fs"; ... L56: function parseBundle(text) { L57: const raw = JSON.parse(text); L58: const envVarsRaw = raw.envVars; ... L168: const emit = (line) => { L169: process.stdout.write(`${line} L170: `); ... L677: return join3( L678: process.env.CONVEYOR_SHARED_DIR || "/var/run/conveyor-workbench", L679: "ssh",

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/boot-I353EAK6.jsView on unpkg · L27

27Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/boot-I353EAK6.js L27: // src/boot/index.ts L28: import { spawn } from "child_process"; L29: import { statSync as statSync4 } from "fs"; ... L56: function parseBundle(text) { L57: const raw = JSON.parse(text); L58: const envVarsRaw = raw.envVars; ... L168: const emit = (line) => { L169: process.stdout.write(`${line} L170: `); ... L677: return join3( L678: process.env.CONVEYOR_SHARED_DIR || "/var/run/conveyor-workbench", L679: "ssh",

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/boot-I353EAK6.jsView on unpkg · L27

runtime/entrypoint.shView file

•path = runtime/entrypoint.sh kind = build_helper sizeBytes = 603 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/entrypoint.shView on unpkg

dist/chunk-36VMMHYD.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @rallycry/conveyor-agent@10.13.18 matchedIdentity = npm:[redacted]:10.13.18 similarity = 0.353 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-36VMMHYD.jsView on unpkg

Source & flagged code

5 flagged

dist/boot-I353EAK6.jsView file

Lines 7-47javascript

7 defaultGit,

8 ensureDir,

9 readAgentVersion,

10 redactToken,

11 reportBootMilestone

12} from "./chunk-KCB7CSWJ.js";

13import {

14 workbenchPort

15} from "./chunk-4VUQ2NPF.js";

16import {

17 startWorkbenchServer

18} from "./chunk-3Z4YQNJV.js";

19import "./chunk-XR6H326I.js";

20import {

21 DEFAULT_WORKBENCH_PORT

22} from "./chunk-JIGG755T.js";

23import {

24 oomWatchdogOptionsFromEnv

25} from "./chunk-ULS4QPRE.js";

26

27// src/boot/index.ts

28import { spawn } from "child_process";

29import { statSync as statSync4 } from "fs";

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/boot-I353EAK6.jsView on unpkg · L27

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/boot-I353EAK6.jsView on unpkg · L27

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/boot-I353EAK6.jsView on unpkg · L27

30import { hostname as osHostname } from "os";

31

32// src/boot/bundle.ts

33function requireString(source, field) {

34 const value = source[field];

35 if (typeof value !== "string") {

36 throw new Error(`bundle missing field: ${field}`);

37 }

38 return value;

39}

40function parseGitPlan(raw) {

41 if (typeof raw !== "object" || raw === null) {

42 throw new Error("bundle missing field: gitPlan");

43 }

44 const obj = raw;

45 const plan = {

46 repoOwner: requireString(obj, "repoOwner"),

47 repoName: requireString(obj, "repoName"),

runtime/entrypoint.shView file

•path = runtime/entrypoint.sh kind = build_helper sizeBytes = 603 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/entrypoint.shView on unpkg

dist/chunk-36VMMHYD.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @rallycry/conveyor-agent@10.13.18 matchedIdentity = npm:[redacted]:10.13.18 similarity = 0.353 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-36VMMHYD.jsView on unpkg