registry / @rallycry/conveyor-agent / 11.0.21
@rallycry/conveyor-agent@11.0.21
Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiNo automatic registry-install hook is present, so the source does not meet the publish-block install-hook policy. The explicit, privileged runner behavior remains a real first-party agent extension lifecycle risk.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Running conveyor-agent boot with the required Conveyor container environment.
Impact
A provisioned runner can expose SSH and alter its agent-control files.
Mechanism
Agent-home rewiring, credential linkage, and SSH daemon startup.
AI rationale
No automatic registry-install hook is present, so the source does not meet the publish-block install-hook policy. The explicit, privileged runner behavior remains a real first-party agent extension lifecycle risk.
Evidence
dist/cli.jsdist/boot-Z3EBJ7GX.js/home/conveyor/.claude/home/conveyor/.config/claude/home/conveyor/.ssh/authorized_keys/var/run/conveyor-workbench/ssh/authorized_keys
Network endpoints1
api.conveyor.rallycryapp.com
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit boot command loads a boot module that rewires agent-home files.
- Boot removes existing links and creates symlinks for Claude and credential files.
- Boot can start sshd with sudo on all interfaces.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The boot path requires an explicit command plus container role, API URL, and bootstrap token.
- The observed API host is package-aligned.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
11 flagged · loading sourcedist/chunk-4ZDIBDQC.jsView file
31function emitFailureEvent(payload) {
L32: process.stderr.write(JSON.stringify(payload) + "\n");
L33: }
...
L39: if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken;
L40: const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, {
L41: headers,
...
L44: if (!response.ok) {
L45: const errorText = await response.text().catch(() => "");
L46: return {
...
L80: const hasBootstrapToken = Boolean(opts.bootstrapToken);
L81: const hasTaskToken = Boolean(process.env.CONVEYOR_TASK_TOKEN);
L82: let lastReason = "unknown";
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunk-4ZDIBDQC.jsView on unpkg · L3131Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-4ZDIBDQC.js
L31: function emitFailureEvent(payload) {
L32: process.stderr.write(JSON.stringify(payload) + "\n");
L33: }
...
L39: if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken;
L40: const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, {
L41: headers,
...
L44: if (!response.ok) {
L45: const errorText = await response.text().catch(() => "");
L46: return {
...
L80: const hasBootstrapToken = Boolean(opts.bootstrapToken);
L81: const hasTaskToken = Boolean(process.env.CONVEYOR_TASK_TOKEN);
L82: let lastReason = "unknown";
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/chunk-4ZDIBDQC.jsView on unpkg · L3131Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/chunk-4ZDIBDQC.js
L31: function emitFailureEvent(payload) {
L32: process.stderr.write(JSON.stringify(payload) + "\n");
L33: }
...
L39: if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken;
L40: const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, {
L41: headers,
...
L44: if (!response.ok) {
L45: const errorText = await response.text().catch(() => "");
L46: return {
...
L80: const hasBootstrapToken = Boolean(opts.bootstrapToken);
L81: const hasTaskToken = Boolean(process.env.CONVEYOR_TASK_TOKEN);
L82: let lastReason = "unknown";
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/chunk-4ZDIBDQC.jsView on unpkg · L31•matchType = normalized_sha256
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/chunk-YMZ6Q55T.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-4ZDIBDQC.jsView on unpkgdist/boot-Z3EBJ7GX.jsView file
35// src/boot/index.ts
L36: import { spawn } from "child_process";
L37: import { statSync as statSync3 } from "fs";
...
L57: provider,
L58: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`,
L59: repoOwner,
...
L69: function parseBundle(text) {
L70: const raw = JSON.parse(text);
L71: const envVarsRaw = raw.envVars;
...
L171: const emit = (line) => {
L172: process.stdout.write(`${line}
L173: `);
Critical
Persistence Backdoor
Source writes persistence or remote-access backdoor material.
dist/boot-Z3EBJ7GX.jsView on unpkg · L3535Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/boot-Z3EBJ7GX.js
L35: // src/boot/index.ts
L36: import { spawn } from "child_process";
L37: import { statSync as statSync3 } from "fs";
...
L57: provider,
L58: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`,
L59: repoOwner,
...
L69: function parseBundle(text) {
L70: const raw = JSON.parse(text);
L71: const envVarsRaw = raw.envVars;
...
L171: const emit = (line) => {
L172: process.stdout.write(`${line}
L173: `);
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/boot-Z3EBJ7GX.jsView on unpkg · L35runtime/entrypoint.shView file
•path = runtime/entrypoint.sh
kind = build_helper
sizeBytes = 436
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
runtime/entrypoint.shView on unpkgdist/chunk-WPXSZKMS.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/chunk-WPXSZKMS.jsView on unpkgdist/chunk-6W6UZ4SJ.jsView file
•matchType = normalized_sha256
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/chunk-6W6UZ4SJ.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-6W6UZ4SJ.jsView on unpkgdist/chunk-W5INK3NE.jsView file
•matchType = normalized_sha256
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/chunk-JG3VMWRQ.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-W5INK3NE.jsView on unpkgdist/chunk-W4LZ7R6Z.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @rallycry/conveyor-agent@11.0.20
matchedIdentity = npm:[redacted]:11.0.20
similarity = 0.852
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-W4LZ7R6Z.jsView on unpkgFindings
4 Critical6 High4 Medium5 Low
CriticalCredential Exfiltrationdist/chunk-4ZDIBDQC.js
CriticalPersistence Backdoordist/boot-Z3EBJ7GX.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-4ZDIBDQC.js
CriticalPrevious Version Dangerous Deltadist/chunk-W4LZ7R6Z.js
HighTrigger Reachable Credential Exfiltrationdist/chunk-4ZDIBDQC.js
HighTrigger Reachable Persistencedist/boot-Z3EBJ7GX.js
HighSemantic Analysis Limiteddist/chunk-WPXSZKMS.js
HighKnown Malware Source Similaritydist/chunk-4ZDIBDQC.js
HighKnown Malware Source Similaritydist/chunk-6W6UZ4SJ.js
HighKnown Malware Source Similaritydist/chunk-W5INK3NE.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperruntime/entrypoint.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @rallycry/conveyor-agent@11.0.21.
See all versions of @rallycry/conveyor-agent for other recorded verdicts.
- Review the evidence and your use of @rallycry/conveyor-agent@11.0.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.