@rallycry/conveyor-agent@10.13.72
Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe package has no npm install hook and the reviewed credential code keeps data within its configured workspace. Its runtime does suppress agent approval prompts, a significant capability consistent with the runner’s PTY setup, so warn without treating the source as confirmed malware.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Starting a structured-event PTY session.
Impact
Agent actions may proceed without interactive per-tool approval, reducing user oversight during a run.
Mechanism
The runner writes temporary Claude settings with the bypass notice disabled and tool approvals suppressed; plan mode is passed as a gate option.
AI rationale
The package has no npm install hook and the reviewed credential code keeps data within its configured workspace. Its runtime does suppress agent approval prompts, a significant capability consistent with the runner’s PTY setup, so warn without treating the source as confirmed malware.
Evidence
dist/chunk-2SN32LM6.js
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest defines only a prepublishOnly lifecycle script; it has no npm install hook.
- The boot code copies credentials from the project’s .claude directory to pod-local storage and repoints a symlink within the configured user workspace.
- The runtime writes temporary Claude settings that suppress the bypass-permissions notice and tool approval prompts for its PTY agent.
- The settings are created when structured event sources start, with plan mode passed as a gate option.
Evidence against
- The observed credential handling is workspace-local; these excerpts do not show credentials being sent to an external recipient.
- File upload uses a URL returned by the active task connection and follows an upload-file operation.
- No npm install-time trigger or concrete malicious behavior was established in the inspected source.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
11 flagged · loading sourcedist/chunk-2SN32LM6.jsView file
119try {
L120: parsed = JSON.parse(line);
L121: } catch {
...
L406: // ── Environment setup / start command ─────────────────────────────────
L407: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(),
L408: z3.object({
...
L1873: "xpack.profiling.enabled": "false",
L1874: "ingest.geoip.downloader.enabled": "false",
L1875: ES_JAVA_OPTS: "-Xms512m -Xmx512m"
...
L1888: connectionEnv: {
L1889: ELASTICSEARCH_URL: "http://elasticsearch:9200"
L1890: },
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunk-2SN32LM6.jsView on unpkg · L119119Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-2SN32LM6.js
L119: try {
L120: parsed = JSON.parse(line);
L121: } catch {
...
L406: // ── Environment setup / start command ─────────────────────────────────
L407: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(),
L408: z3.object({
...
L1873: "xpack.profiling.enabled": "false",
L1874: "ingest.geoip.downloader.enabled": "false",
L1875: ES_JAVA_OPTS: "-Xms512m -Xmx512m"
...
L1888: connectionEnv: {
L1889: ELASTICSEARCH_URL: "http://elasticsearch:9200"
L1890: },
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/chunk-2SN32LM6.jsView on unpkg · L119119Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/chunk-2SN32LM6.js
L119: try {
L120: parsed = JSON.parse(line);
L121: } catch {
...
L406: // ── Environment setup / start command ─────────────────────────────────
L407: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(),
L408: z3.object({
...
L1873: "xpack.profiling.enabled": "false",
L1874: "ingest.geoip.downloader.enabled": "false",
L1875: ES_JAVA_OPTS: "-Xms512m -Xmx512m"
...
L1888: connectionEnv: {
L1889: ELASTICSEARCH_URL: "http://elasticsearch:9200"
L1890: },
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/chunk-2SN32LM6.jsView on unpkg · L119•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/chunk-2SN32LM6.jsView on unpkgdist/boot-ZNL7X5LQ.jsView file
30// src/boot/index.ts
L31: import { spawn } from "child_process";
L32: import { statSync as statSync4 } from "fs";
...
L52: provider,
L53: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`,
L54: repoOwner,
...
L64: function parseBundle(text) {
L65: const raw = JSON.parse(text);
L66: const envVarsRaw = raw.envVars;
...
L191: const emit = (line) => {
L192: process.stdout.write(`${line}
L193: `);
Critical
Persistence Backdoor
Source writes persistence or remote-access backdoor material.
dist/boot-ZNL7X5LQ.jsView on unpkg · L30•matchType = previous_version_dangerous_delta
matchedPackage = @rallycry/conveyor-agent@11.0.21
matchedIdentity = npm:[redacted]:11.0.21
similarity = 0.440
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/boot-ZNL7X5LQ.jsView on unpkg30Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/boot-ZNL7X5LQ.js
L30: // src/boot/index.ts
L31: import { spawn } from "child_process";
L32: import { statSync as statSync4 } from "fs";
...
L52: provider,
L53: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`,
L54: repoOwner,
...
L64: function parseBundle(text) {
L65: const raw = JSON.parse(text);
L66: const envVarsRaw = raw.envVars;
...
L191: const emit = (line) => {
L192: process.stdout.write(`${line}
L193: `);
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/boot-ZNL7X5LQ.jsView on unpkg · L30runtime/entrypoint.shView file
•matchType = normalized_sha256
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = runtime/entrypoint.sh
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
runtime/entrypoint.shView on unpkg•path = runtime/entrypoint.sh
kind = build_helper
sizeBytes = 603
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
runtime/entrypoint.shView on unpkgdist/chunk-EXQ6AHOY.jsView file
•matchType = token_shingles
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/chunk-TOTCEWJD.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-EXQ6AHOY.jsView on unpkgdist/chunk-6W6UZ4SJ.jsView file
•matchType = normalized_sha256
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/chunk-6W6UZ4SJ.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-6W6UZ4SJ.jsView on unpkgFindings
4 Critical6 High4 Medium5 Low
CriticalCredential Exfiltrationdist/chunk-2SN32LM6.js
CriticalPersistence Backdoordist/boot-ZNL7X5LQ.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-2SN32LM6.js
CriticalPrevious Version Dangerous Deltadist/boot-ZNL7X5LQ.js
HighTrigger Reachable Credential Exfiltrationdist/chunk-2SN32LM6.js
HighTrigger Reachable Persistencedist/boot-ZNL7X5LQ.js
HighSemantic Analysis Limiteddist/chunk-2SN32LM6.js
HighKnown Malware Source Similaritydist/chunk-EXQ6AHOY.js
HighKnown Malware Source Similaritydist/chunk-6W6UZ4SJ.js
HighKnown Malware Source Similarityruntime/entrypoint.sh
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperruntime/entrypoint.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @rallycry/conveyor-agent@10.13.72.
See all versions of @rallycry/conveyor-agent for other recorded verdicts.
- Review the evidence and your use of @rallycry/conveyor-agent@10.13.72 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.