registry / @rallycry/conveyor-agent / 11.0.49

@rallycry/conveyor-agent@11.0.49

Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The package configures its own agent sessions with broad permissions and hooks, so this is a guarded first-party agent setup capability warranting a warning. No package-install attack or malicious persistence chain was established.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Preparing a Claude agent session through the package’s runner.

Impact

The agent session receives broad tool permissions and automated hook behavior; source inspection did not establish an attack on a consumer’s global agent configuration.

Mechanism

Writes hook and settings files into the session’s temporary directory and supplies the settings when spawning the agent.

AI rationale

Evidence

dist/chunk-RNE3JAF5.js

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package writes Claude hook and settings files when preparing its own agent session.
The settings include broad tool permissions and hook configuration; the session uses those settings when spawned.
The other flagged locations concern credential-path migration, session transcript paths, and a conditional Git submodule fetch.

Evidence against

The manifest has no preinstall, install, or postinstall hook; prepublishOnly runs the build tool.
The flagged agent setup is invoked during session preparation and targets the package’s temporary session directory.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 1.08 MB of source, external domains: 127.0.0.1, api.conveyor.rallycryapp.com, github.com

Source & flagged code

7 flagged

dist/boot-GD5XMLPS.jsView file

Lines 15-55javascript

15import "./chunk-SXZS2R52.js";

16import {

17 GitPrepJob,

18 defaultGit,

19 ensureDir,

20 reportBootMilestone

21} from "./chunk-VIUZS7V4.js";

22import "./chunk-W4LZ7R6Z.js";

23import "./chunk-372R6E4C.js";

24import "./chunk-SQM2BQ7H.js";

25import {

26 workbenchPort

27} from "./chunk-KMB3BU4S.js";

28import {

29 DEFAULT_WORKBENCH_PORT

30} from "./chunk-6Q6LQBWO.js";

31import {

32 oomWatchdogOptionsFromEnv

33} from "./chunk-6W6UZ4SJ.js";

35// src/boot/index.ts

36import { spawn } from "child_process";

37import { statSync as statSync3 } from "fs";

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/boot-GD5XMLPS.jsView on unpkg · L35

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/boot-GD5XMLPS.jsView on unpkg · L35

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/boot-GD5XMLPS.jsView on unpkg · L35

38import { hostname as osHostname } from "os";

40// src/boot/bundle.ts

41function requireString(source, field) {

42 const value = source[field];

43 if (typeof value !== "string") {

44 throw new Error(`bundle missing field: ${field}`);

45 }

46 return value;

47}

48function parseGitPlan(raw) {

49 if (typeof raw !== "object" || raw === null) {

50 throw new Error("bundle missing field: gitPlan");

51 }

52 const obj = raw;

53 const provider = obj.provider === "forgejo" ? "forgejo" : "github";

54 const repoOwner = requireString(obj, "repoOwner");

55 const repoName = requireString(obj, "repoName");

•matchType = previous_version_dangerous_delta matchedPackage = @rallycry/conveyor-agent@11.0.21 matchedIdentity = npm:[redacted]:11.0.21 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/boot-GD5XMLPS.jsView on unpkg

runtime/entrypoint.shView file

•path = runtime/entrypoint.sh kind = build_helper sizeBytes = 436 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/entrypoint.shView on unpkg

dist/chunk-RNE3JAF5.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-RNE3JAF5.jsView on unpkg

dist/chunk-6W6UZ4SJ.jsView file

•matchType = normalized_sha256 matchedPackage = @rallycry/conveyor-agent@11.0.11 matchedPath = dist/chunk-6W6UZ4SJ.js matchedIdentity = npm:[redacted]:11.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-6W6UZ4SJ.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/boot-GD5XMLPS.jsView file

35// src/boot/index.ts L36: import { spawn } from "child_process"; L37: import { statSync as statSync3 } from "fs"; ... L57: provider, L58: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`, L59: repoOwner, ... L69: function parseBundle(text) { L70: const raw = JSON.parse(text); L71: const envVarsRaw = raw.envVars; ... L171: const emit = (line) => { L172: process.stdout.write(`${line} L173: `);

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/boot-GD5XMLPS.jsView on unpkg · L35

35Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/boot-GD5XMLPS.js L35: // src/boot/index.ts L36: import { spawn } from "child_process"; L37: import { statSync as statSync3 } from "fs"; ... L57: provider, L58: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`, L59: repoOwner, ... L69: function parseBundle(text) { L70: const raw = JSON.parse(text); L71: const envVarsRaw = raw.envVars; ... L171: const emit = (line) => { L172: process.stdout.write(`${line} L173: `);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/boot-GD5XMLPS.jsView on unpkg · L35

Findings

3 Critical3 High4 Medium5 Low

CriticalPersistence Backdoordist/boot-GD5XMLPS.js

CriticalTrigger Reachable Dangerous Capabilitydist/boot-GD5XMLPS.js

CriticalPrevious Version Dangerous Deltadist/boot-GD5XMLPS.js

HighTrigger Reachable Persistencedist/boot-GD5XMLPS.js

HighSemantic Analysis Limiteddist/chunk-RNE3JAF5.js

HighKnown Malware Source Similaritydist/chunk-6W6UZ4SJ.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperruntime/entrypoint.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to @rallycry/conveyor-agent@11.0.49.

See all versions of @rallycry/conveyor-agent for other recorded verdicts.

Review the evidence and your use of @rallycry/conveyor-agent@11.0.49 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 15:29:55.460Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.