registry / @rallycry/conveyor-agent / 11.0.38
@rallycry/conveyor-agent@11.0.38
Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.
AI Security Review
scanned 12d ago · by lpm-firewall-aiSource inspection supports a warning for first-party agent extension setup that enables permissions-bypass mode in the runner harness. The manifest has no install-time hook, and the reviewed token request targets the configured bootstrap service.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Starting structured event sources for a runner session.
Impact
The runner’s agent can operate with reduced permission prompting in the harness environment.
Mechanism
The harness writes Claude hook and settings files for the per-run temporary directory, including acceptance of bypass mode.
AI rationale
Source inspection supports a warning for first-party agent extension setup that enables permissions-bypass mode in the runner harness. The manifest has no install-time hook, and the reviewed token request targets the configured bootstrap service.
Evidence
dist/chunk-GO7TWB7A.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest has only a publish-time build lifecycle hook; no install-time hook is declared.
- The agent harness writes hook settings that pre-accept Claude Code’s permissions-bypass mode.
- The hook settings are created in a per-run temporary directory when structured event sources start.
- The bootstrap token is sent to the configured Conveyor API bootstrap route.
- Runtime setup also wires agent credentials and configuration within the pod workspace.
Evidence against
- The observed bootstrap request uses the supplied token with the configured service’s bootstrap endpoint; no unrelated recipient or credential harvesting was identified.
- No package install-time mutation or remote payload execution was established.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
9 flagged · loading sourcedist/chunk-B4YQABDZ.jsView file
31function emitFailureEvent(payload) {
L32: process.stderr.write(JSON.stringify(payload) + "\n");
L33: }
...
L39: if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken;
L40: const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, {
L41: headers,
...
L44: if (!response.ok) {
L45: const errorText = await response.text().catch(() => "");
L46: return {
...
L80: const hasBootstrapToken = Boolean(opts.bootstrapToken);
L81: const hasTaskToken = Boolean(process.env.CONVEYOR_TASK_TOKEN);
L82: let lastReason = "unknown";
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunk-B4YQABDZ.jsView on unpkg · L3131Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-B4YQABDZ.js
L31: function emitFailureEvent(payload) {
L32: process.stderr.write(JSON.stringify(payload) + "\n");
L33: }
...
L39: if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken;
L40: const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, {
L41: headers,
...
L44: if (!response.ok) {
L45: const errorText = await response.text().catch(() => "");
L46: return {
...
L80: const hasBootstrapToken = Boolean(opts.bootstrapToken);
L81: const hasTaskToken = Boolean(process.env.CONVEYOR_TASK_TOKEN);
L82: let lastReason = "unknown";
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/chunk-B4YQABDZ.jsView on unpkg · L3131Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/chunk-B4YQABDZ.js
L31: function emitFailureEvent(payload) {
L32: process.stderr.write(JSON.stringify(payload) + "\n");
L33: }
...
L39: if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken;
L40: const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, {
L41: headers,
...
L44: if (!response.ok) {
L45: const errorText = await response.text().catch(() => "");
L46: return {
...
L80: const hasBootstrapToken = Boolean(opts.bootstrapToken);
L81: const hasTaskToken = Boolean(process.env.CONVEYOR_TASK_TOKEN);
L82: let lastReason = "unknown";
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/chunk-B4YQABDZ.jsView on unpkg · L31dist/boot-T5HQVF3W.jsView file
35// src/boot/index.ts
L36: import { spawn } from "child_process";
L37: import { statSync as statSync3 } from "fs";
...
L57: provider,
L58: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`,
L59: repoOwner,
...
L69: function parseBundle(text) {
L70: const raw = JSON.parse(text);
L71: const envVarsRaw = raw.envVars;
...
L171: const emit = (line) => {
L172: process.stdout.write(`${line}
L173: `);
Critical
Persistence Backdoor
Source writes persistence or remote-access backdoor material.
dist/boot-T5HQVF3W.jsView on unpkg · L35•matchType = previous_version_dangerous_delta
matchedPackage = @rallycry/conveyor-agent@11.0.21
matchedIdentity = npm:[redacted]:11.0.21
similarity = 0.778
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/boot-T5HQVF3W.jsView on unpkg35Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/boot-T5HQVF3W.js
L35: // src/boot/index.ts
L36: import { spawn } from "child_process";
L37: import { statSync as statSync3 } from "fs";
...
L57: provider,
L58: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`,
L59: repoOwner,
...
L69: function parseBundle(text) {
L70: const raw = JSON.parse(text);
L71: const envVarsRaw = raw.envVars;
...
L171: const emit = (line) => {
L172: process.stdout.write(`${line}
L173: `);
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/boot-T5HQVF3W.jsView on unpkg · L35runtime/entrypoint.shView file
•path = runtime/entrypoint.sh
kind = build_helper
sizeBytes = 436
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
runtime/entrypoint.shView on unpkgdist/chunk-GO7TWB7A.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/chunk-GO7TWB7A.jsView on unpkgdist/chunk-6W6UZ4SJ.jsView file
•matchType = normalized_sha256
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/chunk-6W6UZ4SJ.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-6W6UZ4SJ.jsView on unpkgFindings
4 Critical4 High4 Medium5 Low
CriticalCredential Exfiltrationdist/chunk-B4YQABDZ.js
CriticalPersistence Backdoordist/boot-T5HQVF3W.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-B4YQABDZ.js
CriticalPrevious Version Dangerous Deltadist/boot-T5HQVF3W.js
HighTrigger Reachable Credential Exfiltrationdist/chunk-B4YQABDZ.js
HighTrigger Reachable Persistencedist/boot-T5HQVF3W.js
HighSemantic Analysis Limiteddist/chunk-GO7TWB7A.js
HighKnown Malware Source Similaritydist/chunk-6W6UZ4SJ.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperruntime/entrypoint.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @rallycry/conveyor-agent@11.0.38.
See all versions of @rallycry/conveyor-agent for other recorded verdicts.
- Review the evidence and your use of @rallycry/conveyor-agent@11.0.38 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.