registry / @rallycry/conveyor-agent / 11.0.40

@rallycry/conveyor-agent@11.0.40

Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The manifest has no install-time lifecycle hook, and the flagged source paths show package-aligned boot, bootstrap, submodule, and watchdog behavior. The inspected code does not establish credential exfiltration or another concrete attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Package boot or runtime token refresh in a configured Conveyor environment.

Impact

No confirmed attack surface was established from the inspected source.

Mechanism

Boot setup carries credentials into pod-local storage; refresh uses configured bootstrap credentials and the configured API URL. The inspected code does not establish an unrelated credential recipient or malicious persistence.

AI rationale

Evidence

dist/boot-T5HQVF3W.js

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines only a prepublishOnly build hook; install-time hooks are absent.
The boot code copies Claude credentials into a pod-local file and repoints the credentials symlink as part of boot setup.
Grimoire submodule setup checks for the project's .gitmodules entry and requires a GitHub token.
Claude configuration paths use CLAUDE_CONFIG_DIR or the user's .claude directory.
Bootstrap refresh requires configured bootstrap credentials or a Codespaces name, then uses the configured API URL.
The OOM watchdog reads process information and supports disabling or tuning via environment variables.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

Manifest

Source & flagged code

9 flagged

dist/chunk-UB7QZE25.jsView file

Lines 11-51javascript

11 writeGitCredential

12} from "./chunk-W4LZ7R6Z.js";

13import {

14 buildConveyorSocketOptions,

15 callWithAck,

16 heartbeatStatusFor,

17 loopStatusForRunnerStatus,

18 waitForConnected

19} from "./chunk-IA45XHOA.js";

20import {

21 WorkbenchError,

22 getWorkbenchClient

23} from "./chunk-SQM2BQ7H.js";

24import {

25 workbenchEnabled

26} from "./chunk-KMB3BU4S.js";

28// src/setup/bootstrap.ts

29var BOOTSTRAP_TIMEOUT_MS = 3e4;

30var RETRY_DELAYS_MS = [5e3, 1e4, 2e4];

31function emitFailureEvent(payload) {

32 process.stderr.write(JSON.stringify(payload) + "\n");

33}

34async function singleBootstrapAttempt(apiUrl, instanceName, bootstrapToken, timeoutMs) {

35 const controller = new AbortController();

36 const timer = setTimeout(() => controller.abort(), timeoutMs);

37 try {

38 const headers = {};

39 if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken;

40 const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, {

41 headers,

42 signal: controller.signal

43 });

44 if (!response.ok) {

45 const errorText = await response.text().catch(() => "");

46 return {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-UB7QZE25.jsView on unpkg · L31

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-UB7QZE25.jsView on unpkg · L31

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/chunk-UB7QZE25.jsView on unpkg · L31

47 ok: false,

48 status: response.status,

49 errorText: errorText.slice(0, 500),

50 reason: response.status === 401 || response.status === 403 ? "auth_rejected" : "http_error"

51 };

dist/boot-T5HQVF3W.jsView file

Lines 15-55javascript

15import "./chunk-EKTPDG3G.js";

16import {

17 GitPrepJob,

18 defaultGit,

19 ensureDir,

20 reportBootMilestone

21} from "./chunk-Q4FQOJ7D.js";

22import "./chunk-W4LZ7R6Z.js"

runtime/entrypoint.shView file

•path = runtime/entrypoint.sh kind = build_helper sizeBytes = 436 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/entrypoint.shView on unpkg

dist/chunk-GI2FF7FX.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-GI2FF7FX.jsView on unpkg

dist/chunk-6W6UZ4SJ.jsView file

•matchType = normalized_sha256 matchedPackage = @rallycry/conveyor-agent@11.0.11 matchedPath = dist/chunk-6W6UZ4SJ.js matchedIdentity = npm:[redacted]:11.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-6W6UZ4SJ.jsView on unpkg

Source & flagged code

9 flagged · loading source

dist/chunk-UB7QZE25.jsView file

31function emitFailureEvent(payload) { L32: process.stderr.write(JSON.stringify(payload) + "\n"); L33: } ... L39: if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken; L40: const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, { L41: headers, ... L44: if (!response.ok) { L45: const errorText = await response.text().catch(() => ""); L46: return { ... L80: const hasBootstrapToken = Boolean(opts.bootstrapToken); L81: const hasTaskToken = Boolean(process.env.CONVEYOR_TASK_TOKEN); L82: let lastReason = "unknown";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-UB7QZE25.jsView on unpkg · L31

31Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-UB7QZE25.js L31: function emitFailureEvent(payload) { L32: process.stderr.write(JSON.stringify(payload) + "\n"); L33: } ... L39: if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken; L40: const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, { L41: headers, ... L44: if (!response.ok) { L45: const errorText = await response.text().catch(() => ""); L46: return { ... L80: const hasBootstrapToken = Boolean(opts.bootstrapToken); L81: const hasTaskToken = Boolean(process.env.CONVEYOR_TASK_TOKEN); L82: let lastReason = "unknown";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-UB7QZE25.js

Findings

4 Critical4 High4 Medium5 Low

CriticalCredential Exfiltrationdist/chunk-UB7QZE25.js

CriticalPersistence Backdoordist/boot-T5HQVF3W.js

CriticalTrigger Reachable Dangerous Capabilitydist/chunk-UB7QZE25.js

CriticalPrevious Version Dangerous Deltadist/boot-T5HQVF3W.js

HighTrigger Reachable Credential Exfiltrationdist/chunk-UB7QZE25.js

HighTrigger Reachable Persistencedist/boot-T5HQVF3W.js

HighSemantic Analysis Limiteddist/chunk-GI2FF7FX.js

HighKnown Malware Source Similaritydist/chunk-6W6UZ4SJ.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperruntime/entrypoint.sh

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to @rallycry/conveyor-agent@11.0.40.

See all versions of @rallycry/conveyor-agent for other recorded verdicts.

Review the evidence and your use of @rallycry/conveyor-agent@11.0.40 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 15:28:52.565Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.