registry / @rallycry/conveyor-agent / 10.13.68
@rallycry/conveyor-agent@10.13.68
Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe source shows package-owned runtime setup that reduces Claude Code approval prompts, warranting a warning for agent extension capability. The manifest has no npm install hook, and the inspected credential handling is boot-time workspace setup rather than demonstrated exfiltration.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Starting a PTY agent session through the package.
Impact
The spawned agent can act with fewer interactive approval checks than a user may expect.
Mechanism
The session writes temporary Claude settings and hook files that suppress permission prompts and populate tool approval rules.
AI rationale
The source shows package-owned runtime setup that reduces Claude Code approval prompts, warranting a warning for agent extension capability. The manifest has no npm install hook, and the inspected credential handling is boot-time workspace setup rather than demonstrated exfiltration.
Evidence
dist/chunk-E3QHGYZ2.jsdist/boot-UUPTBQ6R.js
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest defines `prepublishOnly` but no npm install lifecycle hook.
- Boot copies existing Claude credentials into pod-local storage and repoints the credential symlink.
- The flagged Claude path resolves to the configured Claude directory and project transcript files.
- PTY startup writes package-owned Claude settings for the spawned agent, including permission prompt suppression and tool approval rules.
Evidence against
- The inspected settings are written to a temporary PTY directory during runtime startup.
- No credential transmission to an unrelated endpoint was established from the inspected source.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
11 flagged · loading sourcedist/chunk-E3QHGYZ2.jsView file
63function emitFailureEvent(payload) {
L64: process.stderr.write(JSON.stringify(payload) + "\n");
L65: }
...
L71: if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken;
L72: const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, {
L73: headers,
...
L76: if (!response.ok) {
L77: const errorText2 = await response.text().catch(() => "");
L78: return {
...
L112: const hasBootstrapToken = Boolean(opts.bootstrapToken);
L113: const hasTaskToken = Boolean(process.env.CONVEYOR_TASK_TOKEN);
L114: let lastReason = "unknown";
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunk-E3QHGYZ2.jsView on unpkg · L6363Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-E3QHGYZ2.js
L63: function emitFailureEvent(payload) {
L64: process.stderr.write(JSON.stringify(payload) + "\n");
L65: }
...
L71: if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken;
L72: const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, {
L73: headers,
...
L76: if (!response.ok) {
L77: const errorText2 = await response.text().catch(() => "");
L78: return {
...
L112: const hasBootstrapToken = Boolean(opts.bootstrapToken);
L113: const hasTaskToken = Boolean(process.env.CONVEYOR_TASK_TOKEN);
L114: let lastReason = "unknown";
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/chunk-E3QHGYZ2.jsFindings
4 Critical6 High4 Medium5 Low
CriticalCredential Exfiltrationdist/chunk-E3QHGYZ2.js
CriticalPersistence Backdoordist/boot-UUPTBQ6R.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-E3QHGYZ2.js
CriticalPrevious Version Dangerous Deltadist/chunk-E3QHGYZ2.js
HighTrigger Reachable Credential Exfiltrationdist/chunk-E3QHGYZ2.js
HighTrigger Reachable Persistencedist/boot-UUPTBQ6R.js
HighSemantic Analysis Limiteddist/chunk-E3QHGYZ2.js
HighKnown Malware Source Similaritydist/chunk-EXQ6AHOY.js
HighKnown Malware Source Similaritydist/chunk-6W6UZ4SJ.js
HighKnown Malware Source Similarityruntime/entrypoint.sh
MediumNetwork
Affected versions and remediation
This report applies to @rallycry/conveyor-agent@10.13.68.
See all versions of @rallycry/conveyor-agent for other recorded verdicts.
- Review the evidence and your use of @rallycry/conveyor-agent@10.13.68 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.