@rallycry/conveyor-agent@11.0.10: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@rallycry/conveyor-agent@11.0.10: Suspicious npm security report | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/chunk-PGNV3DGV.jsView file

136try { L137: parsed = JSON.parse(payloadJson); L138: } catch { ... L552: // ── Environment setup / start command ───────────────────────────────── L553: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L554: z3.object({ ... L2202: "xpack.profiling.enabled": "false", L2203: "ingest.geoip.downloader.enabled": "false", L2204: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2217: connectionEnv: { L2218: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2219: },

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-PGNV3DGV.jsView on unpkg · L136

136Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-PGNV3DGV.js L136: try { L137: parsed = JSON.parse(payloadJson); L138: } catch { ... L552: // ── Environment setup / start command ───────────────────────────────── L553: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L554: z3.object({ ... L2202: "xpack.profiling.enabled": "false", L2203: "ingest.geoip.downloader.enabled": "false", L2204: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2217: connectionEnv: { L2218: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2219: },

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-PGNV3DGV.jsView on unpkg · L136

136Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/chunk-PGNV3DGV.js L136: try { L137: parsed = JSON.parse(payloadJson); L138: } catch { ... L552: // ── Environment setup / start command ───────────────────────────────── L553: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L554: z3.object({ ... L2202: "xpack.profiling.enabled": "false", L2203: "ingest.geoip.downloader.enabled": "false", L2204: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2217: connectionEnv: { L2218: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2219: },

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/chunk-PGNV3DGV.jsView on unpkg · L136

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-PGNV3DGV.jsView on unpkg

dist/boot-ZE6BM7L2.jsView file

33// src/boot/index.ts L34: import { spawn } from "child_process"; L35: import { statSync as statSync3 } from "fs"; ... L55: provider, L56: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`, L57: repoOwner, ... L67: function parseBundle(text) { L68: const raw = JSON.parse(text); L69: const envVarsRaw = raw.envVars; ... L169: const emit = (line) => { L170: process.stdout.write(`${line} L171: `);

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/boot-ZE6BM7L2.jsView on unpkg · L33

•matchType = previous_version_dangerous_delta matchedPackage = @rallycry/conveyor-agent@10.13.59 matchedIdentity = npm:[redacted]:10.13.59 similarity = 0.550 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/boot-ZE6BM7L2.jsView on unpkg

33Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/boot-ZE6BM7L2.js L33: // src/boot/index.ts L34: import { spawn } from "child_process"; L35: import { statSync as statSync3 } from "fs"; ... L55: provider, L56: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`, L57: repoOwner, ... L67: function parseBundle(text) { L68: const raw = JSON.parse(text); L69: const envVarsRaw = raw.envVars; ... L169: const emit = (line) => { L170: process.stdout.write(`${line} L171: `);

runtime/entrypoint.shView file

•path = runtime/entrypoint.sh kind = build_helper sizeBytes = 603 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/entrypoint.shView on unpkg

Source & flagged code

8 flagged

dist/chunk-PGNV3DGV.jsView file

136try { L137: parsed = JSON.parse(payloadJson); L138: } catch { ... L552: // ── Environment setup / start command ───────────────────────────────── L553: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L554: z3.object({ ... L2202: "xpack.profiling.enabled": "false", L2203: "ingest.geoip.downloader.enabled": "false", L2204: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2217: connectionEnv: { L2218: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2219: },

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-PGNV3DGV.jsView on unpkg · L136

136Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-PGNV3DGV.js L136: try { L137: parsed = JSON.parse(payloadJson); L138: } catch { ... L552: // ── Environment setup / start command ───────────────────────────────── L553: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L554: z3.object({ ... L2202: "xpack.profiling.enabled": "false", L2203: "ingest.geoip.downloader.enabled": "false", L2204: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2217: connectionEnv: { L2218: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2219: },

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-PGNV3DGV.jsView on unpkg · L136

136Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/chunk-PGNV3DGV.js L136: try { L137: parsed = JSON.parse(payloadJson); L138: } catch { ... L552: // ── Environment setup / start command ───────────────────────────────── L553: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L554: z3.object({ ... L2202: "xpack.profiling.enabled": "false", L2203: "ingest.geoip.downloader.enabled": "false", L2204: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2217: connectionEnv: { L2218: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2219: },

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/chunk-PGNV3DGV.jsView on unpkg · L136

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-PGNV3DGV.jsView on unpkg

dist/boot-ZE6BM7L2.jsView file

Lines 13-53javascript

13 runPreReadyBinds

14} from "./chunk-SR66HQKB.js";

15import "./chunk-JG3VMWRQ.js";

16import {

17 GitPrepJob,

18 defaultGit,

19 ensureDir,

20 reportBootMilestone

21} from

runtime/entrypoint.shView file

•path = runtime/entrypoint.sh kind = build_helper sizeBytes = 603 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/entrypoint.shView on unpkg