@rallycry/conveyor-agent@10.13.59: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@rallycry/conveyor-agent@10.13.59: Suspicious npm security report | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/chunk-JCRP6K6T.jsView file

62function emitFailureEvent(payload) { L63: process.stderr.write(JSON.stringify(payload) + "\n"); L64: } ... L70: if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken; L71: const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, { L72: headers, ... L75: if (!response.ok) { L76: const errorText = await response.text().catch(() => ""); L77: return { ... L111: const hasBootstrapToken = Boolean(opts.bootstrapToken); L112: const hasTaskToken = Boolean(process.env.CONVEYOR_TASK_TOKEN); L113: let lastReason = "unknown";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-JCRP6K6T.jsView on unpkg · L62

62Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-JCRP6K6T.js L62: function emitFailureEvent(payload) { L63: process.stderr.write(JSON.stringify(payload) + "\n"); L64: } ... L70: if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken; L71: const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, { L72: headers, ... L75: if (!response.ok) { L76: const errorText = await response.text().catch(() => ""); L77: return { ... L111: const hasBootstrapToken = Boolean(opts.bootstrapToken); L112: const hasTaskToken = Boolean(process.env.CONVEYOR_TASK_TOKEN); L113: let lastReason = "unknown";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-JCRP6K6T.jsView on unpkg · L62

•matchType = previous_version_dangerous_delta matchedPackage = @rallycry/conveyor-agent@10.13.56 matchedIdentity = npm:[redacted]:10.13.56 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-JCRP6K6T.jsView on unpkg

62Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/chunk-JCRP6K6T.js L62: function emitFailureEvent(payload) { L63: process.stderr.write(JSON.stringify(payload) + "\n"); L64: } ... L70: if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken; L71: const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, { L72: headers, ... L75: if (!response.ok) { L76: const errorText = await response.text().catch(() => ""); L77: return { ... L111: const hasBootstrapToken = Boolean(opts.bootstrapToken); L112: const hasTaskToken = Boolean(process.env.CONVEYOR_TASK_TOKEN); L113: let lastReason = "unknown";

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/chunk-JCRP6K6T.jsView on unpkg · L62

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-JCRP6K6T.jsView on unpkg

dist/boot-7OPX55AO.jsView file

27// src/boot/index.ts L28: import { spawn } from "child_process"; L29: import { statSync as statSync4 } from "fs"; ... L49: provider, L50: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`, L51: repoOwner, ... L61: function parseBundle(text) { L62: const raw = JSON.parse(text); L63: const envVarsRaw = raw.envVars; ... L187: const emit = (line) => { L188: process.stdout.write(`${line} L189: `);

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/boot-7OPX55AO.jsView on unpkg · L27

27Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/boot-7OPX55AO.js L27: // src/boot/index.ts L28: import { spawn } from "child_process"; L29: import { statSync as statSync4 } from "fs"; ... L49: provider, L50: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`, L51: repoOwner, ... L61: function parseBundle(text) { L62: const raw = JSON.parse(text); L63: const envVarsRaw = raw.envVars; ... L187: const emit = (line) => { L188: process.stdout.write(`${line} L189: `);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/boot-7OPX55AO.jsView on unpkg · L27

runtime/entrypoint.shView file

•path = runtime/entrypoint.sh kind = build_helper sizeBytes = 603 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/entrypoint.shView on unpkg

Source & flagged code

8 flagged

dist/chunk-JCRP6K6T.jsView file

62function emitFailureEvent(payload) { L63: process.stderr.write(JSON.stringify(payload) + "\n"); L64: } ... L70: if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken; L71: const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, { L72: headers, ... L75: if (!response.ok) { L76: const errorText = await response.text().catch(() => ""); L77: return { ... L111: const hasBootstrapToken = Boolean(opts.bootstrapToken); L112: const hasTaskToken = Boolean(process.env.CONVEYOR_TASK_TOKEN); L113: let lastReason = "unknown";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-JCRP6K6T.jsView on unpkg · L62

62Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-JCRP6K6T.js L62: function emitFailureEvent(payload) { L63: process.stderr.write(JSON.stringify(payload) + "\n"); L64: } ... L70: if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken; L71: const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, { L72: headers, ... L75: if (!response.ok) { L76: const errorText = await response.text().catch(() => ""); L77: return { ... L111: const hasBootstrapToken = Boolean(opts.bootstrapToken); L112: const hasTaskToken = Boolean(process.env.CONVEYOR_TASK_TOKEN); L113: let lastReason = "unknown";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-JCRP6K6T.jsView on unpkg · L62

•matchType = previous_version_dangerous_delta matchedPackage = @rallycry/conveyor-agent@10.13.56 matchedIdentity = npm:[redacted]:10.13.56 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-JCRP6K6T.jsView on unpkg

62Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/chunk-JCRP6K6T.js L62: function emitFailureEvent(payload) { L63: process.stderr.write(JSON.stringify(payload) + "\n"); L64: } ... L70: if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken; L71: const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, { L72: headers, ... L75: if (!response.ok) { L76: const errorText = await response.text().catch(() => ""); L77: return { ... L111: const hasBootstrapToken = Boolean(opts.bootstrapToken); L112: const hasTaskToken = Boolean(process.env.CONVEYOR_TASK_TOKEN); L113: let lastReason = "unknown";

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/chunk-JCRP6K6T.jsView on unpkg · L62

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-JCRP6K6T.jsView on unpkg

dist/boot-7OPX55AO.jsView file

Lines 7-47javascript

7 defaultGit,

8 ensureDir,

9 readAgentVersion,

10 redactToken,

11 reportBootMilestone

12} from "./chunk-QZN6HVUY.js";

13import {

14 workbenchPort

15} from "./chunk-4VUQ2NPF.js";

runtime/entrypoint.shView file

•path = runtime/entrypoint.sh kind = build_helper sizeBytes = 603 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/entrypoint.shView on unpkg