registry / @rallycry/conveyor-agent / 11.0.8

@rallycry/conveyor-agent@11.0.8

Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Inspected source does not substantiate the scanner’s malicious label: the manifest has no install hook, and the flagged credential and upload behavior is consistent with the agent runtime. The required flagged paths were inspected; source similarity labels alone do not establish malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Runtime boot invokes credential wiring; an agent tool invocation can request a workspace file upload.

Impact

The inspected behavior supports local agent operation and requested file sharing; no confirmed attack surface was established.

Mechanism

Boot copies Claude credentials to a pod-local path and repoints a local symlink. The upload tool accepts a requested file path and resolves relative paths under the configured workspace.

AI rationale

Evidence

dist/boot-ZE6BM7L2.jsdist/chunk-SKTCDL4K.js

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines only `prepublishOnly` as a lifecycle script; it runs `tsup`.
The boot code copies Claude credentials to a pod-local file and repoints a symlink within the runtime setup.
The flagged agent-configuration locations handle Claude project paths and a Grimoire submodule that requires a GitHub token; they do not show credential forwarding to an unrelated recipient.
File upload is exposed through an attachment tool that takes a path from its invocation and resolves relative paths within the configured workspace.

Evidence against

No inspected source shows install-time execution, credential exfiltration, or an unconsented write to a foreign AI-agent control surface.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

Source & flagged code

18 flagged

dist/chunk-SKTCDL4K.jsView file

136try { L137: parsed = JSON.parse(payloadJson); L138: } catch { ... L551: // ── Environment setup / start command ───────────────────────────────── L552: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L553: z3.object({ ... L2101: "xpack.profiling.enabled": "false", L2102: "ingest.geoip.downloader.enabled": "false", L2103: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2116: connectionEnv: { L2117: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2118: },

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-SKTCDL4K.jsView on unpkg · L136

136Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-SKTCDL4K.js L136: try { L137: parsed = JSON.parse(payloadJson); L138: } catch { ... L551: // ── Environment setup / start command ───────────────────────────────── L552: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L553: z3.object({ ... L2101: "xpack.profiling.enabled": "false", L2102: "ingest.geoip.downloader.enabled": "false", L2103: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2116: connectionEnv: { L2117: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2118: },

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-SKTCDL4K.jsView on unpkg · L136

136Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/chunk-SKTCDL4K.js L136: try { L137: parsed = JSON.parse(payloadJson); L138: } catch { ... L551: // ── Environment setup / start command ───────────────────────────────── L552: z3.object({ type: z3.literal("setup_output"), stream: z3.string(), data: z3.string() }).passthrough(), L553: z3.object({ ... L2101: "xpack.profiling.enabled": "false", L2102: "ingest.geoip.downloader.enabled": "false", L2103: ES_JAVA_OPTS: "-Xms512m -Xmx512m" ... L2116: connectionEnv: { L2117: ELASTICSEARCH_URL: "http://elasticsearch:9200" L2118: },

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/chunk-SKTCDL4K.jsView on unpkg · L136

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-SKTCDL4K.jsView on unpkg

dist/boot-ZE6BM7L2.jsView file

Lines 13-53javascript

13 runPreReadyBinds

14} from "./chunk-SR66HQKB.js";

15import "./chunk-JG3VMWRQ.js";

16import {

17 GitPrepJob,

18 defaultGit,

19 ensureDir,

20 reportBootMilestone

21} from

runtime/entrypoint.shView file

•matchType = normalized_sha256 matchedPackage = @rallycry/conveyor-agent@11.0.11 matchedPath = runtime/entrypoint.sh matchedIdentity = npm:[redacted]:11.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/entrypoint.shView on unpkg

•path = runtime/entrypoint.sh kind = build_helper sizeBytes = 603 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/entrypoint.shView on unpkg

dist/chunk-APP6Y2D7.jsView file

•matchType = normalized_sha256 matchedPackage = @rallycry/conveyor-agent@11.0.11 matchedPath = dist/chunk-YMZ6Q55T.js matchedIdentity = npm:[redacted]:11.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-APP6Y2D7.jsView on unpkg

dist/chunk-GL2DIQEQ.jsView file

•matchType = normalized_sha256 matchedPackage = @rallycry/conveyor-agent@11.0.11 matchedPath = dist/chunk-GL2DIQEQ.js matchedIdentity = npm:[redacted]:11.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-GL2DIQEQ.jsView on unpkg

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @rallycry/conveyor-agent@11.0.11 matchedPath = dist/cli.js matchedIdentity = npm:[redacted]:11.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

dist/chunk-IBAIJY7V.jsView file

•matchType = normalized_sha256 matchedPackage = @rallycry/conveyor-agent@11.0.11 matchedPath = dist/chunk-IBAIJY7V.js matchedIdentity = npm:[redacted]:11.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-IBAIJY7V.jsView on unpkg

dist/chunk-TOTCEWJD.jsView file

•matchType = normalized_sha256 matchedPackage = @rallycry/conveyor-agent@11.0.11 matchedPath = dist/chunk-TOTCEWJD.js matchedIdentity = npm:[redacted]:11.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-TOTCEWJD.jsView on unpkg

dist/gate-cli.jsView file

•matchType = normalized_sha256 matchedPackage = @rallycry/conveyor-agent@11.0.11 matchedPath = dist/gate-cli.js matchedIdentity = npm:[redacted]:11.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/gate-cli.jsView on unpkg

dist/chunk-6W6UZ4SJ.jsView file

•matchType = normalized_sha256 matchedPackage = @rallycry/conveyor-agent@11.0.11 matchedPath = dist/chunk-6W6UZ4SJ.js matchedIdentity = npm:[redacted]:11.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-6W6UZ4SJ.jsView on unpkg

dist/chunk-JG3VMWRQ.jsView file

•matchType = normalized_sha256 matchedPackage = @rallycry/conveyor-agent@11.0.11 matchedPath = dist/chunk-JG3VMWRQ.js matchedIdentity = npm:[redacted]:11.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-JG3VMWRQ.jsView on unpkg

Source & flagged code

18 flagged · loading source

dist/chunk-SKTCDL4K.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-SKTCDL4K.jsView on unpkg · L136

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-SKTCDL4K.jsView on unpkg · L136

Findings

4 Critical13 High4 Medium5 Low

CriticalCredential Exfiltrationdist/chunk-SKTCDL4K.js

CriticalPersistence Backdoordist/boot-ZE6BM7L2.js

CriticalTrigger Reachable Dangerous Capabilitydist/chunk-SKTCDL4K.js

CriticalPrevious Version Dangerous Deltadist/boot-ZE6BM7L2.js

HighTrigger Reachable Credential Exfiltrationdist/chunk-SKTCDL4K.js

HighTrigger Reachable Persistencedist/boot-ZE6BM7L2.js

HighSemantic Analysis Limiteddist/chunk-SKTCDL4K.js

HighKnown Malware Source Similaritydist/boot-ZE6BM7L2.js

HighKnown Malware Source Similaritydist/chunk-APP6Y2D7.js

HighKnown Malware Source Similaritydist/chunk-GL2DIQEQ.js

HighKnown Malware Source Similarity

Affected versions and remediation

This report applies to @rallycry/conveyor-agent@11.0.8.

See all versions of @rallycry/conveyor-agent for other recorded verdicts.

Review the evidence and your use of @rallycry/conveyor-agent@11.0.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 15:23:40.141Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.