@rallycry/conveyor-agent@10.13.56: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@rallycry/conveyor-agent@10.13.56: Suspicious npm security report | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/boot-RW7SNO6X.jsView file

27// src/boot/index.ts L28: import { spawn } from "child_process"; L29: import { statSync as statSync4 } from "fs"; ... L49: provider, L50: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`, L51: repoOwner, ... L61: function parseBundle(text) { L62: const raw = JSON.parse(text); L63: const envVarsRaw = raw.envVars; ... L187: const emit = (line) => { L188: process.stdout.write(`${line} L189: `);

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/boot-RW7SNO6X.jsView on unpkg · L27

27Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/boot-RW7SNO6X.js L27: // src/boot/index.ts L28: import { spawn } from "child_process"; L29: import { statSync as statSync4 } from "fs"; ... L49: provider, L50: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`, L51: repoOwner, ... L61: function parseBundle(text) { L62: const raw = JSON.parse(text); L63: const envVarsRaw = raw.envVars; ... L187: const emit = (line) => { L188: process.stdout.write(`${line} L189: `);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/boot-RW7SNO6X.jsView on unpkg · L27

27Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/boot-RW7SNO6X.js L27: // src/boot/index.ts L28: import { spawn } from "child_process"; L29: import { statSync as statSync4 } from "fs"; ... L49: provider, L50: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`, L51: repoOwner, ... L61: function parseBundle(text) { L62: const raw = JSON.parse(text); L63: const envVarsRaw = raw.envVars; ... L187: const emit = (line) => { L188: process.stdout.write(`${line} L189: `);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/boot-RW7SNO6X.jsView on unpkg · L27

runtime/entrypoint.shView file

•path = runtime/entrypoint.sh kind = build_helper sizeBytes = 603 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/entrypoint.shView on unpkg

dist/chunk-PG3Z6RIC.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @rallycry/conveyor-agent@10.13.55 matchedIdentity = npm:[redacted]:10.13.55 similarity = 0.850 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-PG3Z6RIC.jsView on unpkg

Source & flagged code

5 flagged

dist/boot-RW7SNO6X.jsView file

Lines 7-47javascript

7 defaultGit,

8 ensureDir,

9 readAgentVersion,

10 redactToken,

11 reportBootMilestone

12} from "./chunk-7765OQU5.js";

13import {

14 workbenchPort

15} from "./chunk-4VUQ2NPF.js";

16import {

17 startWorkbenchServer

18} from "./chunk-DSP4KR4B.js";

19import "./chunk-UAGIXPYD.js";

20import {

21 DEFAULT_WORKBENCH_PORT

22} from "./chunk-JIGG755T.js";

23import {

24 oomWatchdogOptionsFromEnv

25} from "./chunk-ULS4QPRE.js";

26

27// src/boot/index.ts

28import { spawn } from "child_process";

29import { statSync as statSync4 } from "fs";

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/boot-RW7SNO6X.jsView on unpkg · L27

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/boot-RW7SNO6X.jsView on unpkg · L27

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/boot-RW7SNO6X.jsView on unpkg · L27

30import { hostname as osHostname } from "os";

31

32// src/boot/bundle.ts

33function requireString(source, field) {

34 const value = source[field];

35 if (typeof value !== "string") {

36 throw new Error(`bundle missing field: ${field}`);

37 }

38 return value;

39}

40function parseGitPlan(raw) {

41 if (typeof raw !== "object" || raw === null) {

42 throw new Error("bundle missing field: gitPlan");

43 }

44 const obj = raw;

45 const provider = obj.provider === "forgejo" ? "forgejo" : "github";

46 const repoOwner = requireString(obj, "repoOwner");

47 const repoName = requireString(obj, "repoName");

runtime/entrypoint.shView file

•path = runtime/entrypoint.sh kind = build_helper sizeBytes = 603 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/entrypoint.shView on unpkg

dist/chunk-PG3Z6RIC.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @rallycry/conveyor-agent@10.13.55 matchedIdentity = npm:[redacted]:10.13.55 similarity = 0.850 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-PG3Z6RIC.jsView on unpkg