@rallycry/conveyor-agent@11.0.16
Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package has no registry-install lifecycle hook, so the configuration changes are not automatic on installation. Its explicit boot command nevertheless mutates AI-agent controls and credentials, warranting a warning.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Running conveyor-agent boot with the required Conveyor container environment variables.
Impact
Can pre-accept Claude permission settings and alter local agent configuration in the boot container.
Mechanism
Agent configuration mutation and credential wiring during container boot.
AI rationale
The package has no registry-install lifecycle hook, so the configuration changes are not automatic on installation. Its explicit boot command nevertheless mutates AI-agent controls and credentials, warranting a warning.
Evidence
dist/boot-CCRZMY2P.jsdist/cli.js/home/conveyor/.claude.json/home/conveyor/.claude/.credentials.json/home/conveyor/.conveyor-codex
Network endpoints1
api.conveyor.rallycryapp.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The boot command seeds Claude configuration with permission bypass acceptance and a model option.
- Boot deletes and rewires Claude configuration and credential paths in the container home.
- Boot fetches a credential bundle from the configured API using a bootstrap token.
- The CLI contains a fixed Rallycry API endpoint.
Evidence against
- package.json has no install, postinstall, or preinstall hook; prepublishOnly only builds the package.
- Boot requires an explicit command plus container role, API URL, and bootstrap token.
- No source evidence sends locally harvested credentials to an unrelated endpoint.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
17 flagged · loading sourcedist/chunk-GAUVITY7.jsView file
136try {
L137: parsed = JSON.parse(payloadJson);
L138: } catch {
...
L552: // ── Environment setup / start command ─────────────────────────────────
L553: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(),
L554: z3.object({
...
L2202: "xpack.profiling.enabled": "false",
L2203: "ingest.geoip.downloader.enabled": "false",
L2204: ES_JAVA_OPTS: "-Xms512m -Xmx512m"
...
L2217: connectionEnv: {
L2218: ELASTICSEARCH_URL: "http://elasticsearch:9200"
L2219: },
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunk-GAUVITY7.jsView on unpkg · L136136Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-GAUVITY7.js
L136: try {
L137: parsed = JSON.parse(payloadJson);
L138: } catch {
...
L552: // ── Environment setup / start command ─────────────────────────────────
L553: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(),
L554: z3.object({
...
L2202: "xpack.profiling.enabled": "false",
L2203: "ingest.geoip.downloader.enabled": "false",
L2204: ES_JAVA_OPTS: "-Xms512m -Xmx512m"
...
L2217: connectionEnv: {
L2218: ELASTICSEARCH_URL: "http://elasticsearch:9200"
L2219: },
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/chunk-GAUVITY7.jsView on unpkg · L136136Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/chunk-GAUVITY7.js
L136: try {
L137: parsed = JSON.parse(payloadJson);
L138: } catch {
...
L552: // ── Environment setup / start command ─────────────────────────────────
L553: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(),
L554: z3.object({
...
L2202: "xpack.profiling.enabled": "false",
L2203: "ingest.geoip.downloader.enabled": "false",
L2204: ES_JAVA_OPTS: "-Xms512m -Xmx512m"
...
L2217: connectionEnv: {
L2218: ELASTICSEARCH_URL: "http://elasticsearch:9200"
L2219: },
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/chunk-GAUVITY7.jsView on unpkg · L136•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/chunk-GAUVITY7.jsView on unpkg•matchType = token_shingles
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/chunk-PGNV3DGV.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-GAUVITY7.jsView on unpkgdist/boot-CCRZMY2P.jsView file
33// src/boot/index.ts
L34: import { spawn } from "child_process";
L35: import { statSync as statSync3 } from "fs";
...
L55: provider,
L56: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`,
L57: repoOwner,
...
L67: function parseBundle(text) {
L68: const raw = JSON.parse(text);
L69: const envVarsRaw = raw.envVars;
...
L169: const emit = (line) => {
L170: process.stdout.write(`${line}
L171: `);
Critical
Persistence Backdoor
Source writes persistence or remote-access backdoor material.
dist/boot-CCRZMY2P.jsView on unpkg · L3333Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/boot-CCRZMY2P.js
L33: // src/boot/index.ts
L34: import { spawn } from "child_process";
L35: import { statSync as statSync3 } from "fs";
...
L55: provider,
L56: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`,
L57: repoOwner,
...
L67: function parseBundle(text) {
L68: const raw = JSON.parse(text);
L69: const envVarsRaw = raw.envVars;
...
L169: const emit = (line) => {
L170: process.stdout.write(`${line}
L171: `);
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/boot-CCRZMY2P.jsView on unpkg · L33•matchType = normalized_sha256
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/boot-ZE6BM7L2.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/boot-CCRZMY2P.jsView on unpkgruntime/entrypoint.shView file
•path = runtime/entrypoint.sh
kind = build_helper
sizeBytes = 436
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
runtime/entrypoint.shView on unpkgdist/chunk-GL2DIQEQ.jsView file
•matchType = normalized_sha256
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/chunk-GL2DIQEQ.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-GL2DIQEQ.jsView on unpkgdist/chunk-M4SD2ESQ.jsView file
•matchType = normalized_sha256
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/chunk-YMZ6Q55T.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-M4SD2ESQ.jsView on unpkgdist/chunk-W4LZ7R6Z.jsView file
•matchType = normalized_sha256
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/chunk-W4LZ7R6Z.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-W4LZ7R6Z.jsView on unpkgdist/chunk-7TSQXIN3.jsView file
•matchType = normalized_sha256
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/chunk-IBAIJY7V.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-7TSQXIN3.jsView on unpkgdist/gate-cli.jsView file
•matchType = normalized_sha256
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/gate-cli.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/gate-cli.jsView on unpkgdist/chunk-6W6UZ4SJ.jsView file
•matchType = normalized_sha256
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/chunk-6W6UZ4SJ.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-6W6UZ4SJ.jsView on unpkgdist/chunk-QLMNQSJL.jsView file
•matchType = normalized_sha256
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/chunk-JG3VMWRQ.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-QLMNQSJL.jsView on unpkgdist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @rallycry/conveyor-agent@11.0.10
matchedIdentity = npm:[redacted]:11.0.10
similarity = 0.778
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkgFindings
4 Critical12 High4 Medium5 Low
CriticalCredential Exfiltrationdist/chunk-GAUVITY7.js
CriticalPersistence Backdoordist/boot-CCRZMY2P.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-GAUVITY7.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/chunk-GAUVITY7.js
HighTrigger Reachable Persistencedist/boot-CCRZMY2P.js
HighSemantic Analysis Limiteddist/chunk-GAUVITY7.js
HighKnown Malware Source Similaritydist/boot-CCRZMY2P.js
HighKnown Malware Source Similaritydist/chunk-GL2DIQEQ.js
HighKnown Malware Source Similaritydist/chunk-M4SD2ESQ.js
HighKnown Malware Source Similaritydist/chunk-W4LZ7R6Z.js
HighKnown Malware Source Similaritydist/chunk-7TSQXIN3.js
HighKnown Malware Source Similaritydist/gate-cli.js
HighKnown Malware Source Similaritydist/chunk-6W6UZ4SJ.js
HighKnown Malware Source Similaritydist/chunk-GAUVITY7.js
HighKnown Malware Source Similaritydist/chunk-QLMNQSJL.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperruntime/entrypoint.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @rallycry/conveyor-agent@11.0.16.
See all versions of @rallycry/conveyor-agent for other recorded verdicts.
- Review the evidence and your use of @rallycry/conveyor-agent@11.0.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.