registry / @rallycry/conveyor-agent / 11.0.50

@rallycry/conveyor-agent@11.0.50

Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Source inspection found no install-time attack: the package’s only lifecycle hook builds the package, and the flagged boot and agent-setting behavior is gated by container or session startup. These behaviors align with running an agent inside a configured Conveyor container, and the inspected code does not establish a concrete malicious chain.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

The boot setup runs in a configured Conveyor agent or workbench container; temporary agent settings are created when a session starts.

Impact

The code manages agent permissions and persistent container state, but the inspected paths do not establish credential theft, an unconsented install-time change, or another concrete attack.

Mechanism

Boot configures pod-local Claude storage and credentials, while the runner supplies temporary settings and hooks to its spawned agent. The optional submodule fetch requires a matching project entry and a supplied token.

AI rationale

Evidence

package.jsondist/boot-GD5XMLPS.jsdist/chunk-5TMS6MVB.jsdist/chunk-V5WR2F2P.jsdist/chunk-6W6UZ4SJ.js

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes the agent and gate CLIs; its only lifecycle hook is prepublishOnly running the build tool.
The boot path requires an explicit container role and bootstrap credentials before proceeding.
Boot code places Claude credentials in pod-local storage and wires the container home for persistence.
The Claude settings and hook helper are written to a temporary directory when the agent session starts.
The optional Grimoire fetch is gated on a matching project submodule and a supplied GitHub token.
The flagged OOM watchdog reads process and memory information for container resource management.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

Manifest

Source & flagged code

7 flagged

dist/boot-GD5XMLPS.jsView file

Lines 15-55javascript

15import "./chunk-SXZS2R52.js";

16import {

17 GitPrepJob,

18 defaultGit,

19 ensureDir,

20 reportBootMilestone

21} from "./chunk-VIUZS7V4.js";

22import "./chunk-W4LZ7R6Z.js";

23import "./chunk-372R6E4C.js";

24import "./chunk-SQM2BQ7H.js";

25import {

26 workbenchPort

27} from "./chunk-KMB3BU4S.js";

28import {

29 DEFAULT_WORKBENCH_PORT

30} from "./chunk-6Q6LQBWO.js";

31import {

32 oomWatchdogOptionsFromEnv

33} from "./chunk-6W6UZ4SJ.js";

35// src/boot/index.ts

36import { spawn } from "child_process";

37import { statSync as statSync3 } from "fs";

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/boot-GD5XMLPS.jsView on unpkg · L35

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/boot-GD5XMLPS.jsView on unpkg · L35

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/boot-GD5XMLPS.jsView on unpkg · L35

38import { hostname as osHostname } from "os";

40// src/boot/bundle.ts

41function requireString(source, field) {

42 const value = source[field];

43 if (typeof value !== "string") {

44 throw new Error(`bundle missing field: ${field}`);

45 }

46 return value;

47}

48function parseGitPlan(raw) {

49 if (typeof raw !== "object" || raw === null) {

50 throw new Error("bundle missing field: gitPlan");

51 }

52 const obj = raw;

53 const provider = obj.provider === "forgejo" ? "forgejo" : "github";

54 const repoOwner = requireString(obj, "repoOwner");

55 const repoName = requireString(obj, "repoName");

•matchType = previous_version_dangerous_delta matchedPackage = @rallycry/conveyor-agent@11.0.21 matchedIdentity = npm:[redacted]:11.0.21 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/boot-GD5XMLPS.jsView on unpkg

runtime/entrypoint.shView file

•path = runtime/entrypoint.sh kind = build_helper sizeBytes = 436 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/entrypoint.shView on unpkg

dist/chunk-5TMS6MVB.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-5TMS6MVB.jsView on unpkg

dist/chunk-6W6UZ4SJ.jsView file

•matchType = normalized_sha256 matchedPackage = @rallycry/conveyor-agent@11.0.11 matchedPath = dist/chunk-6W6UZ4SJ.js matchedIdentity = npm:[redacted]:11.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-6W6UZ4SJ.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/boot-GD5XMLPS.jsView file

35// src/boot/index.ts L36: import { spawn } from "child_process"; L37: import { statSync as statSync3 } from "fs"; ... L57: provider, L58: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`, L59: repoOwner, ... L69: function parseBundle(text) { L70: const raw = JSON.parse(text); L71: const envVarsRaw = raw.envVars; ... L171: const emit = (line) => { L172: process.stdout.write(`${line} L173: `);

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/boot-GD5XMLPS.jsView on unpkg · L35

35Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/boot-GD5XMLPS.js L35: // src/boot/index.ts L36: import { spawn } from "child_process"; L37: import { statSync as statSync3 } from "fs"; ... L57: provider, L58: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`, L59: repoOwner, ... L69: function parseBundle(text) { L70: const raw = JSON.parse(text); L71: const envVarsRaw = raw.envVars; ... L171: const emit = (line) => { L172: process.stdout.write(`${line} L173: `);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/boot-GD5XMLPS.jsView on unpkg · L35

Findings

3 Critical3 High4 Medium5 Low

CriticalPersistence Backdoordist/boot-GD5XMLPS.js

CriticalTrigger Reachable Dangerous Capabilitydist/boot-GD5XMLPS.js

CriticalPrevious Version Dangerous Deltadist/boot-GD5XMLPS.js

HighTrigger Reachable Persistencedist/boot-GD5XMLPS.js

HighSemantic Analysis Limiteddist/chunk-5TMS6MVB.js

HighKnown Malware Source Similaritydist/chunk-6W6UZ4SJ.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperruntime/entrypoint.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to @rallycry/conveyor-agent@11.0.50.

See all versions of @rallycry/conveyor-agent for other recorded verdicts.

Review the evidence and your use of @rallycry/conveyor-agent@11.0.50 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 15:30:02.895Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.