registry / @rallycry/conveyor-agent / 11.1.1

@rallycry/conveyor-agent@11.1.1

Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Source inspection found no concrete attack behavior. The scanner's lifecycle and agent-configuration hints resolve to a build-only publish hook, pod/session setup, guarded workspace skill handling, and memory-pressure recovery.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Package publish or normal agent boot and session startup.

Impact

The inspected behavior supports package build and agent operation; the watchdog may terminate a large foreign process group during memory pressure.

Mechanism

The publish hook runs the build tool; runtime code wires pod credentials, prepares workspace skills, writes per-session hook settings, and monitors memory pressure.

AI rationale

Evidence

package.jsondist/boot-3FWYGHSN.jsdist/chunk-NLVZSOKK.jsdist/chunk-V5WR2F2P.jsdist/chunk-K2PCYBXI.jsdist/chunk-6W6UZ4SJ.js

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest's only publish lifecycle script runs tsup; it defines no install-time hook.
Boot copies legacy Claude credentials to a pod-local file, then wires credential and agent directories for the pod.
Claude transcripts use the configured Claude home and are stored under a project-specific path.
The Grimoire setup checks for a matching submodule and a token before fetching; bundled skills are materialized in the workspace.
The Git token helper updates the Git credential and token files for repository access.
The OOM watchdog checks for memory pressure and an eligible foreign process group before sending SIGKILL.
Claude hook settings are written in a temporary session directory and passed into the agent spawn.

Evidence against

The watchdog can kill an eligible foreign process group with SIGKILL under memory pressure, but the inspected code ties this to its OOM recovery function.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Source & flagged code

9 flagged

dist/boot-3FWYGHSN.jsView file

Lines 16-56javascript

16import {

17 GitPrepJob,

18 defaultGit,

19 ensureDir,

20 reportBootMilestone

21} from "./chunk-VIUZS7V4.js";

22import "./chunk-W4LZ7R6Z.js";

23import "./chunk-372R6E4C.js";

24import "./chunk-SQM2BQ7H.js";

25import {

26 workbenchPort

27} from "./chunk-KMB3BU4S.js";

28import {

29 DEFAULT_WORKBENCH_PORT

30} from "./chunk-6Q6LQBWO.js";

31import {

32 oomWatchdogOptionsFromEnv

33} from "./chunk-6W6UZ4SJ.js";

34import "./chunk-JSBRDJBE.js";

36// src/boot/index.ts

37import { spawn } from "child_process";

38import { statSync as statSync3 } from "fs";

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/boot-3FWYGHSN.jsView on unpkg · L36

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/boot-3FWYGHSN.jsView on unpkg · L36

High

Child Process

Package source references child process execution.

dist/boot-3FWYGHSN.jsView on unpkg · L36

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/boot-3FWYGHSN.jsView on unpkg · L36

39import { hostname as osHostname } from "os";

41// src/boot/bundle.ts

42function requireString(source, field) {

43 const value = source[field];

44 if (typeof value !== "string") {

45 throw new Error(`bundle missing field: ${field}`);

46 }

47 return value;

48}

49function parseGitPlan(raw) {

50 if (typeof raw !== "object" || raw === null) {

51 throw new Error("bundle missing field: gitPlan");

52 }

53 const obj = raw;

54 const provider = obj.provider === "forgejo" ? "forgejo" : "github";

55 const repoOwner = requireString(obj, "repoOwner");

56 const repoName = requireString(obj, "repoName");

•matchType = previous_version_dangerous_delta matchedPackage = @rallycry/conveyor-agent@11.0.50 matchedIdentity = npm:[redacted]:11.0.50 similarity = 0.519 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/boot-3FWYGHSN.jsView on unpkg

dist/chunk-NLVZSOKK.jsView file

415Cross-file remote execution chain: dist/chunk-NLVZSOKK.js spawns dist/chunk-MILKMRPU.js; helper contains network access plus dynamic code execution. L415: event: async ({ event }) => { L416: const sink = process.env.${OPENCODE_EVENTS_FILE_ENV}; L417: if (!sink || !event || event.type === "message.part.delta") return; ... L438: try { L439: return JSON.parse(trimmed); L440: } catch { ... L533: } L534: function buildResultEvent(exitCode, usage, assistantText, stderrTail, reportedError) { L535: if (exitCode === 0) { ... L1043: await this.readOnce(); L1044: this.buffer += this.decoder.end(); L1045: if (this.buffer.length > 0) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-NLVZSOKK.jsView on unpkg · L415

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-NLVZSOKK.jsView on unpkg

runtime/entrypoint.shView file

•path = runtime/entrypoint.sh kind = build_helper sizeBytes = 436 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/entrypoint.shView on unpkg

dist/chunk-6W6UZ4SJ.jsView file

•matchType = normalized_sha256 matchedPackage = @rallycry/conveyor-agent@11.0.11 matchedPath = dist/chunk-6W6UZ4SJ.js matchedIdentity = npm:[redacted]:11.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-6W6UZ4SJ.jsView on unpkg

Source & flagged code

9 flagged · loading source

dist/boot-3FWYGHSN.jsView file

36// src/boot/index.ts L37: import { spawn } from "child_process"; L38: import { statSync as statSync3 } from "fs"; ... L58: provider, L59: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`, L60: repoOwner, ... L70: function parseBundle(text) { L71: const raw = JSON.parse(text); L72: const envVarsRaw = raw.envVars; ... L172: const emit = (line) => { L173: process.stdout.write(`${line} L174: `);

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/boot-3FWYGHSN.jsView on unpkg · L36

36Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/boot-3FWYGHSN.js L36: // src/boot/index.ts L37: import { spawn } from "child_process"; L38: import { statSync as statSync3 } from "fs"; ... L58: provider, L59: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`, L60: repoOwner, ... L70: function parseBundle(text) { L71: const raw = JSON.parse(text); L72: const envVarsRaw = raw.envVars; ... L172: const emit = (line) => { L173: process.stdout.write(`${line} L174: `);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/boot-3FWYGHSN.jsView on unpkg · L36

Findings

3 Critical6 High4 Medium5 Low

CriticalPersistence Backdoordist/boot-3FWYGHSN.js

CriticalTrigger Reachable Dangerous Capabilitydist/boot-3FWYGHSN.js

CriticalPrevious Version Dangerous Deltadist/boot-3FWYGHSN.js

HighChild Processdist/boot-3FWYGHSN.js

HighShell

HighCross File Remote Execution Contextdist/chunk-NLVZSOKK.js

HighTrigger Reachable Persistencedist/boot-3FWYGHSN.js

HighSemantic Analysis Limiteddist/chunk-NLVZSOKK.js

HighKnown Malware Source Similaritydist/chunk-6W6UZ4SJ.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperruntime/entrypoint.sh

Affected versions and remediation

This report applies to @rallycry/conveyor-agent@11.1.1.

See all versions of @rallycry/conveyor-agent for other recorded verdicts.

Review the evidence and your use of @rallycry/conveyor-agent@11.1.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-16 20:34:34.798Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.