@rallycry/conveyor-agent@11.0.5: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@rallycry/conveyor-agent@11.0.5: Suspicious npm security report | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/chunk-J2NPWBVZ.jsView file

134try { L135: parsed = JSON.parse(payloadJson); L136: } catch { ... L549: // ── Environment setup / start command ───────────────────────────────── L550: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L551: z3.object({ ... L2099: "xpack.profiling.enabled": "false", L2100: "ingest.geoip.downloader.enabled": "false", L2101: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2114: connectionEnv: { L2115: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2116: },

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-J2NPWBVZ.jsView on unpkg · L134

134Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-J2NPWBVZ.js L134: try { L135: parsed = JSON.parse(payloadJson); L136: } catch { ... L549: // ── Environment setup / start command ───────────────────────────────── L550: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L551: z3.object({ ... L2099: "xpack.profiling.enabled": "false", L2100: "ingest.geoip.downloader.enabled": "false", L2101: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2114: connectionEnv: { L2115: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2116: },

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-J2NPWBVZ.jsView on unpkg · L134

134Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/chunk-J2NPWBVZ.js L134: try { L135: parsed = JSON.parse(payloadJson); L136: } catch { ... L549: // ── Environment setup / start command ───────────────────────────────── L550: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L551: z3.object({ ... L2099: "xpack.profiling.enabled": "false", L2100: "ingest.geoip.downloader.enabled": "false", L2101: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2114: connectionEnv: { L2115: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2116: },

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/chunk-J2NPWBVZ.jsView on unpkg · L134

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-J2NPWBVZ.jsView on unpkg

dist/boot-7XH4FFLO.jsView file

30// src/boot/index.ts L31: import { spawn } from "child_process"; L32: import { statSync as statSync4 } from "fs"; ... L52: provider, L53: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`, L54: repoOwner, ... L64: function parseBundle(text) { L65: const raw = JSON.parse(text); L66: const envVarsRaw = raw.envVars; ... L192: const emit = (line) => { L193: process.stdout.write(`${line} L194: `);

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/boot-7XH4FFLO.jsView on unpkg · L30

•matchType = previous_version_dangerous_delta matchedPackage = @rallycry/conveyor-agent@10.13.59 matchedIdentity = npm:[redacted]:10.13.59 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/boot-7XH4FFLO.jsView on unpkg

30Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/boot-7XH4FFLO.js L30: // src/boot/index.ts L31: import { spawn } from "child_process"; L32: import { statSync as statSync4 } from "fs"; ... L52: provider, L53: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`, L54: repoOwner, ... L64: function parseBundle(text) { L65: const raw = JSON.parse(text); L66: const envVarsRaw = raw.envVars; ... L192: const emit = (line) => { L193: process.stdout.write(`${line} L194: `);

runtime/entrypoint.shView file

•path = runtime/entrypoint.sh kind = build_helper sizeBytes = 603 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/entrypoint.shView on unpkg

Source & flagged code

8 flagged

dist/chunk-J2NPWBVZ.jsView file

134try { L135: parsed = JSON.parse(payloadJson); L136: } catch { ... L549: // ── Environment setup / start command ───────────────────────────────── L550: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L551: z3.object({ ... L2099: "xpack.profiling.enabled": "false", L2100: "ingest.geoip.downloader.enabled": "false", L2101: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2114: connectionEnv: { L2115: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2116: },

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-J2NPWBVZ.jsView on unpkg · L134

134Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-J2NPWBVZ.js L134: try { L135: parsed = JSON.parse(payloadJson); L136: } catch { ... L549: // ── Environment setup / start command ───────────────────────────────── L550: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L551: z3.object({ ... L2099: "xpack.profiling.enabled": "false", L2100: "ingest.geoip.downloader.enabled": "false", L2101: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2114: connectionEnv: { L2115: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2116: },

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-J2NPWBVZ.jsView on unpkg · L134

134Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/chunk-J2NPWBVZ.js L134: try { L135: parsed = JSON.parse(payloadJson); L136: } catch { ... L549: // ── Environment setup / start command ───────────────────────────────── L550: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L551: z3.object({ ... L2099: "xpack.profiling.enabled": "false", L2100: "ingest.geoip.downloader.enabled": "false", L2101: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2114: connectionEnv: { L2115: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2116: },

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/chunk-J2NPWBVZ.jsView on unpkg · L134

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-J2NPWBVZ.jsView on unpkg

dist/boot-7XH4FFLO.jsView file

Lines 10-50javascript

10} from "./chunk-XORJ6SII.js";

11import "./chunk-W6VILPQE.js";

12import {

13 GitPrepJob,

14 defaultGit,

15 ensureDir,

16 redactToken,

17 reportBootMilestone

18} from

runtime/entrypoint.shView file

•path = runtime/entrypoint.sh kind = build_helper sizeBytes = 603 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/entrypoint.shView on unpkg