@rallycry/conveyor-agent@11.0.46
Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.
AI Security Review
scanned 11d ago · by lpm-firewall-aiSource inspection found no npm install hook or concrete malicious behavior. The runtime’s generated agent configuration lowers permission friction during structured sessions, which warrants a warning under the agent capability policy.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A structured agent session starts through the package runtime.
Impact
The session can act with fewer interactive permission prompts; this is a consequential agent capability, but the inspected flow does not establish a covert control hijack or attack.
Mechanism
The runtime writes settings and hook files in a temporary directory, then passes the settings path to the agent spawn configuration.
AI rationale
Source inspection found no npm install hook or concrete malicious behavior. The runtime’s generated agent configuration lowers permission friction during structured sessions, which warrants a warning under the agent capability policy.
Evidence
dist/chunk-2SIMOUOD.js
Decision evidence
public snapshotAI called this Suspicious at 81.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest has no npm install lifecycle hook; its only publish hook runs the build.
- The boot module copies Claude credentials within the configured workspace paths.
- Agent startup writes temporary Claude settings and hooks for structured sessions.
- Those settings accept the bypass-permissions prompt and configure tool permissions for the agent.
- Grimoire retrieval is conditional on a matching workspace submodule and a supplied GitHub token.
- The watchdog identifies the largest process group outside its own group and may kill it under memory pressure.
Evidence against
- The inspected agent settings are generated in a temporary session directory and passed into the agent spawn path.
- The boot credential wiring copies a credential file locally; no external recipient is shown in the inspected excerpt.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
7 flagged · loading sourcedist/boot-5AZLXH5M.jsView file
35// src/boot/index.ts
L36: import { spawn } from "child_process";
L37: import { statSync as statSync3 } from "fs";
...
L57: provider,
L58: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`,
L59: repoOwner,
...
L69: function parseBundle(text) {
L70: const raw = JSON.parse(text);
L71: const envVarsRaw = raw.envVars;
...
L171: const emit = (line) => {
L172: process.stdout.write(`${line}
L173: `);
Critical
Persistence Backdoor
Source writes persistence or remote-access backdoor material.
dist/boot-5AZLXH5M.jsView on unpkg · L3535Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/boot-5AZLXH5M.js
L35: // src/boot/index.ts
L36: import { spawn } from "child_process";
L37: import { statSync as statSync3 } from "fs";
...
L57: provider,
L58: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`,
L59: repoOwner,
...
L69: function parseBundle(text) {
L70: const raw = JSON.parse(text);
L71: const envVarsRaw = raw.envVars;
...
L171: const emit = (line) => {
L172: process.stdout.write(`${line}
L173: `);
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/boot-5AZLXH5M.jsView on unpkg · L35Findings
3 Critical3 High4 Medium5 Low
CriticalPersistence Backdoordist/boot-5AZLXH5M.js
CriticalTrigger Reachable Dangerous Capabilitydist/boot-5AZLXH5M.js
CriticalPrevious Version Dangerous Deltadist/boot-5AZLXH5M.js
HighTrigger Reachable Persistencedist/boot-5AZLXH5M.js
HighSemantic Analysis Limiteddist/chunk-2SIMOUOD.js
HighKnown Malware Source Similaritydist/chunk-6W6UZ4SJ.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperruntime/entrypoint.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @rallycry/conveyor-agent@11.0.46.
See all versions of @rallycry/conveyor-agent for other recorded verdicts.
- Review the evidence and your use of @rallycry/conveyor-agent@11.0.46 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.