registry / AI-agent capability abuse / @rallycry/conveyor-agent / 11.0.44

@rallycry/conveyor-agent@11.0.44

Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The session settings deliberately bypass agent permission prompts, so this is a concrete dangerous capability that merits a warning. The inspected evidence does not establish malicious exfiltration or unconsented install-time behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user starts a runner session that spawns the agent.

Impact

Agent actions can proceed without per-tool approval prompts during the runner session.

Mechanism

The runner writes settings and hook files in a temporary directory and passes the settings to the agent, enabling permission bypass and automatic tool approval for that session.

AI rationale

Evidence

dist/chunk-42YPRICN.js

Network endpoints1

api.conveyor.rallycryapp.com

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json declares only prepublishOnly for build; no install lifecycle hook is present.
The runner writes temporary Claude settings that suppress the dangerous-mode prompt and auto-approve tool calls.
Runner startup creates those settings in a temporary directory for the spawned agent session.
Bootstrap sends its supplied token to the configured API URL; the inspected call does not establish unrelated credential exfiltration.
Credential wiring copies a legacy credentials file into pod-local storage and repoints its symlink.

Evidence against

The permission-bypassing settings are part of the runner’s session setup, not an npm install hook or persistent agent configuration write.
The inspected submodule fetch requires a matching project submodule, missing local content, and a GitHub token.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Source & flagged code

9 flagged

dist/chunk-KMBMW3J3.jsView file

Lines 11-51javascript

11 writeGitCredential

12} from "./chunk-W4LZ7R6Z.js";

13import {

14 buildConveyorSocketOptions,

15 callWithAck,

16 heartbeatStatusFor,

17 loopStatusForRunnerStatus,

18 waitForConnected

19} from "./chunk-IA45XHOA.js";

20import {

21 WorkbenchError,

22 getWorkbenchClient

23} from "./chunk-SQM2BQ7H.js";

24import {

25 workbenchEnabled

26} from "./chunk-KMB3BU4S.js";

28// src/setup/bootstrap.ts

29var BOOTSTRAP_TIMEOUT_MS = 3e4;

30var RETRY_DELAYS_MS = [5e3, 1e4, 2e4];

31function emitFailureEvent(payload) {

32 process.stderr.write(JSON.stringify(payload) + "\n");

33}

34async function singleBootstrapAttempt(apiUrl, instanceName, bootstrapToken, timeoutMs) {

35 const controller = new AbortController();

36 const timer = setTimeout(() => controller.abort(), timeoutMs);

37 try {

38 const headers = {};

39 if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken;

40 const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, {

41 headers,

42 signal: controller.signal

43 });

44 if (!response.ok) {

45 const errorText = await response.text().catch(() => "");

46 return {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-KMBMW3J3.jsView on unpkg · L31

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-KMBMW3J3.jsView on unpkg · L31

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/chunk-KMBMW3J3.jsView on unpkg · L31

47 ok: false,

48 status: response.status,

49 errorText: errorText.slice(0, 500),

50 reason: response.status === 401 || response.status === 403 ? "auth_rejected" : "http_error"

51 };

dist/boot-T5HQVF3W.jsView file

Lines 15-55javascript

15import "./chunk-EKTPDG3G.js";

16import {

17 GitPrepJob,

18 defaultGit,

19 ensureDir,

20 reportBootMilestone

21} from "./chunk-Q4FQOJ7D.js";

22import "./chunk-W4LZ7R6Z.js"

runtime/entrypoint.shView file

•path = runtime/entrypoint.sh kind = build_helper sizeBytes = 436 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/entrypoint.shView on unpkg

dist/chunk-42YPRICN.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-42YPRICN.jsView on unpkg

dist/chunk-6W6UZ4SJ.jsView file

•matchType = normalized_sha256 matchedPackage = @rallycry/conveyor-agent@11.0.11 matchedPath = dist/chunk-6W6UZ4SJ.js matchedIdentity = npm:[redacted]:11.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-6W6UZ4SJ.jsView on unpkg

Source & flagged code

9 flagged · loading source

dist/chunk-KMBMW3J3.jsView file

31function emitFailureEvent(payload) { L32: process.stderr.write(JSON.stringify(payload) + "\n"); L33: } ... L39: if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken; L40: const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, { L41: headers, ... L44: if (!response.ok) { L45: const errorText = await response.text().catch(() => ""); L46: return { ... L80: const hasBootstrapToken = Boolean(opts.bootstrapToken); L81: const hasTaskToken = Boolean(process.env.CONVEYOR_TASK_TOKEN); L82: let lastReason = "unknown";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-KMBMW3J3.jsView on unpkg · L31

31Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-KMBMW3J3.js L31: function emitFailureEvent(payload) { L32: process.stderr.write(JSON.stringify(payload) + "\n"); L33: } ... L39: if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken; L40: const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, { L41: headers, ... L44: if (!response.ok) { L45: const errorText = await response.text().catch(() => ""); L46: return { ... L80: const hasBootstrapToken = Boolean(opts.bootstrapToken); L81: const hasTaskToken = Boolean(process.env.CONVEYOR_TASK_TOKEN); L82: let lastReason = "unknown";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-KMBMW3J3.js

Findings

4 Critical4 High4 Medium5 Low

CriticalCredential Exfiltrationdist/chunk-KMBMW3J3.js

CriticalPersistence Backdoordist/boot-T5HQVF3W.js

CriticalTrigger Reachable Dangerous Capabilitydist/chunk-KMBMW3J3.js

CriticalPrevious Version Dangerous Deltadist/boot-T5HQVF3W.js

HighTrigger Reachable Credential Exfiltrationdist/chunk-KMBMW3J3.js

HighTrigger Reachable Persistencedist/boot-T5HQVF3W.js

HighSemantic Analysis Limiteddist/chunk-42YPRICN.js

HighKnown Malware Source Similaritydist/chunk-6W6UZ4SJ.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperruntime/entrypoint.sh

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to @rallycry/conveyor-agent@11.0.44.

See all versions of @rallycry/conveyor-agent for other recorded verdicts.

Review the evidence and your use of @rallycry/conveyor-agent@11.0.44 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 15:31:26.197Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.