@rallycry/conveyor-agent@11.0.20
Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package does not meet the install-hook malware boundary because it has no registry-install lifecycle trigger. Its explicit runtime behavior still weakens AI-agent permission controls and enables remote-agent command execution, so it should be warned rather than marked clean.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Running conveyor-agent boot or starting the configured workbench mode.
Impact
A holder of the workbench token or the configured remote control path can run commands and read files in the agent container with its credentials.
Mechanism
Seeds Claude permission-bypass settings and provides authenticated local shell and file access.
AI rationale
The package does not meet the install-hook malware boundary because it has no registry-install lifecycle trigger. Its explicit runtime behavior still weakens AI-agent permission controls and enables remote-agent command execution, so it should be warned rather than marked clean.
Evidence
dist/boot-Z3EBJ7GX.jsdist/chunk-EIHZRSYI.jsdist/cli.js~/.claude.json~/.claude~/.config/claude.claude/.credentials.json
Network endpoints1
api.conveyor.rallycryapp.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with low false-positive risk.
Evidence for warning
- The boot path overwrites Claude configuration to mark permission bypass and workspace trust as accepted.
- The boot path replaces the user's Claude home, credentials, memory, and configuration paths with package-selected links.
- A token-authenticated localhost workbench accepts arbitrary shell commands and reads arbitrary requested files.
- The CLI defaults to a remote Conveyor API and receives task-controlled agent work and credentials.
Evidence against
- package.json has no preinstall, install, or postinstall hook; its only lifecycle script is prepublishOnly.
- The workbench listener binds to 127.0.0.1 and rejects requests without its configured token.
- The observed remote API is package-aligned and static inspection found no separate secret-exfiltration endpoint.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
13 flagged · loading sourcedist/chunk-POK3QCGN.jsView file
138try {
L139: parsed = JSON.parse(payloadJson);
L140: } catch {
...
L554: // ── Environment setup / start command ─────────────────────────────────
L555: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(),
L556: z3.object({
...
L2214: "xpack.profiling.enabled": "false",
L2215: "ingest.geoip.downloader.enabled": "false",
L2216: ES_JAVA_OPTS: "-Xms512m -Xmx512m"
...
L2229: connectionEnv: {
L2230: ELASTICSEARCH_URL: "http://elasticsearch:9200"
L2231: },
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunk-POK3QCGN.jsView on unpkg · L138138Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-POK3QCGN.js
L138: try {
L139: parsed = JSON.parse(payloadJson);
L140: } catch {
...
L554: // ── Environment setup / start command ─────────────────────────────────
L555: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(),
L556: z3.object({
...
L2214: "xpack.profiling.enabled": "false",
L2215: "ingest.geoip.downloader.enabled": "false",
L2216: ES_JAVA_OPTS: "-Xms512m -Xmx512m"
...
L2229: connectionEnv: {
L2230: ELASTICSEARCH_URL: "http://elasticsearch:9200"
L2231: },
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/chunk-POK3QCGN.jsView on unpkg · L138138Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/chunk-POK3QCGN.js
L138: try {
L139: parsed = JSON.parse(payloadJson);
L140: } catch {
...
L554: // ── Environment setup / start command ─────────────────────────────────
L555: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(),
L556: z3.object({
...
L2214: "xpack.profiling.enabled": "false",
L2215: "ingest.geoip.downloader.enabled": "false",
L2216: ES_JAVA_OPTS: "-Xms512m -Xmx512m"
...
L2229: connectionEnv: {
L2230: ELASTICSEARCH_URL: "http://elasticsearch:9200"
L2231: },
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/chunk-POK3QCGN.jsView on unpkg · L138•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/chunk-POK3QCGN.jsView on unpkg•matchType = token_shingles
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/chunk-PGNV3DGV.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-POK3QCGN.jsView on unpkgdist/boot-Z3EBJ7GX.jsView file
35// src/boot/index.ts
L36: import { spawn } from "child_process";
L37: import { statSync as statSync3 } from "fs";
...
L57: provider,
L58: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`,
L59: repoOwner,
...
L69: function parseBundle(text) {
L70: const raw = JSON.parse(text);
L71: const envVarsRaw = raw.envVars;
...
L171: const emit = (line) => {
L172: process.stdout.write(`${line}
L173: `);
Critical
Persistence Backdoor
Source writes persistence or remote-access backdoor material.
dist/boot-Z3EBJ7GX.jsView on unpkg · L35•matchType = previous_version_dangerous_delta
matchedPackage = @rallycry/conveyor-agent@11.0.16
matchedIdentity = npm:[redacted]:11.0.16
similarity = 0.667
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/boot-Z3EBJ7GX.jsView on unpkg35Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/boot-Z3EBJ7GX.js
L35: // src/boot/index.ts
L36: import { spawn } from "child_process";
L37: import { statSync as statSync3 } from "fs";
...
L57: provider,
L58: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`,
L59: repoOwner,
...
L69: function parseBundle(text) {
L70: const raw = JSON.parse(text);
L71: const envVarsRaw = raw.envVars;
...
L171: const emit = (line) => {
L172: process.stdout.write(`${line}
L173: `);
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/boot-Z3EBJ7GX.jsView on unpkg · L35runtime/entrypoint.shView file
•path = runtime/entrypoint.sh
kind = build_helper
sizeBytes = 436
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
runtime/entrypoint.shView on unpkgdist/chunk-JBGPARLG.jsView file
•matchType = normalized_sha256
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/chunk-YMZ6Q55T.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-JBGPARLG.jsView on unpkgdist/chunk-W4LZ7R6Z.jsView file
•matchType = normalized_sha256
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/chunk-W4LZ7R6Z.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-W4LZ7R6Z.jsView on unpkgdist/chunk-6W6UZ4SJ.jsView file
•matchType = normalized_sha256
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/chunk-6W6UZ4SJ.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-6W6UZ4SJ.jsView on unpkgdist/chunk-W5INK3NE.jsView file
•matchType = normalized_sha256
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/chunk-JG3VMWRQ.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-W5INK3NE.jsView on unpkgFindings
4 Critical8 High4 Medium5 Low
CriticalCredential Exfiltrationdist/chunk-POK3QCGN.js
CriticalPersistence Backdoordist/boot-Z3EBJ7GX.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-POK3QCGN.js
CriticalPrevious Version Dangerous Deltadist/boot-Z3EBJ7GX.js
HighTrigger Reachable Credential Exfiltrationdist/chunk-POK3QCGN.js
HighTrigger Reachable Persistencedist/boot-Z3EBJ7GX.js
HighSemantic Analysis Limiteddist/chunk-POK3QCGN.js
HighKnown Malware Source Similaritydist/chunk-JBGPARLG.js
HighKnown Malware Source Similaritydist/chunk-W4LZ7R6Z.js
HighKnown Malware Source Similaritydist/chunk-6W6UZ4SJ.js
HighKnown Malware Source Similaritydist/chunk-POK3QCGN.js
HighKnown Malware Source Similaritydist/chunk-W5INK3NE.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperruntime/entrypoint.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @rallycry/conveyor-agent@11.0.20.
See all versions of @rallycry/conveyor-agent for other recorded verdicts.
- Review the evidence and your use of @rallycry/conveyor-agent@11.0.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.