@rallycry/conveyor-agent@11.1.2
Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe inspected boot and skill-fetch behaviors are product-aligned, and no concrete credential theft or persistence attack was established. The PTY runner suppresses agent permission prompts, leaving a meaningful dangerous capability risk.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A runner session initializes its PTY settings.
Impact
Agent tool actions may proceed without the usual interactive approval prompt.
Mechanism
The runner writes settings into its temporary directory and applies permission-mode-dependent tool gating.
AI rationale
The inspected boot and skill-fetch behaviors are product-aligned, and no concrete credential theft or persistence attack was established. The PTY runner suppresses agent permission prompts, leaving a meaningful dangerous capability risk.
Evidence
dist/chunk-U3X4LTN4.js
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest has no install-time hook; its prepublish hook only runs the build tool.
- The boot credential wiring copies a workspace credential file to a pod-local path.
- The workspace fetch of agent skills requires a matching submodule and a token.
- The PTY runner writes temporary agent settings that suppress the dangerous-mode prompt; its setup also distinguishes planning mode from build mode.
- The runner invokes that settings setup during session initialization.
Evidence against
- The reviewed boot and skill setup code does not establish credential export or an unrelated persistence mechanism.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
8 flagged · loading sourcedist/boot-3FWYGHSN.jsView file
36// src/boot/index.ts
L37: import { spawn } from "child_process";
L38: import { statSync as statSync3 } from "fs";
...
L58: provider,
L59: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`,
L60: repoOwner,
...
L70: function parseBundle(text) {
L71: const raw = JSON.parse(text);
L72: const envVarsRaw = raw.envVars;
...
L172: const emit = (line) => {
L173: process.stdout.write(`${line}
L174: `);
Critical
Persistence Backdoor
Source writes persistence or remote-access backdoor material.
dist/boot-3FWYGHSN.jsView on unpkg · L3636Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/boot-3FWYGHSN.js
L36: // src/boot/index.ts
L37: import { spawn } from "child_process";
L38: import { statSync as statSync3 } from "fs";
...
L58: provider,
L59: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`,
L60: repoOwner,
...
L70: function parseBundle(text) {
L71: const raw = JSON.parse(text);
L72: const envVarsRaw = raw.envVars;
...
L172: const emit = (line) => {
L173: process.stdout.write(`${line}
L174: `);
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/boot-3FWYGHSN.jsView on unpkg · L3636// src/boot/index.ts
L37: import { spawn } from "child_process";
L38: import { statSync as statSync3 } from "fs";
High
Child Process
Package source references child process execution.
dist/boot-3FWYGHSN.jsView on unpkg · L3636Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/boot-3FWYGHSN.js
L36: // src/boot/index.ts
L37: import { spawn } from "child_process";
L38: import { statSync as statSync3 } from "fs";
...
L58: provider,
L59: cloneUrl: typeof obj.cloneUrl === "string" ? obj.cloneUrl : `https://github.com/${repoOwner}/${repoName}.git`,
L60: repoOwner,
...
L70: function parseBundle(text) {
L71: const raw = JSON.parse(text);
L72: const envVarsRaw = raw.envVars;
...
L172: const emit = (line) => {
L173: process.stdout.write(`${line}
L174: `);
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/boot-3FWYGHSN.jsView on unpkg · L36dist/chunk-U3X4LTN4.jsView file
415Cross-file remote execution chain: dist/chunk-U3X4LTN4.js spawns dist/chunk-MILKMRPU.js; helper contains network access plus dynamic code execution.
L415: event: async ({ event }) => {
L416: const sink = process.env.${OPENCODE_EVENTS_FILE_ENV};
L417: if (!sink || !event || event.type === "message.part.delta") return;
...
L438: try {
L439: return JSON.parse(trimmed);
L440: } catch {
...
L533: }
L534: function buildResultEvent(exitCode, usage, assistantText, stderrTail, reportedError) {
L535: if (exitCode === 0) {
...
L1043: await this.readOnce();
L1044: this.buffer += this.decoder.end();
L1045: if (this.buffer.length > 0) {
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/chunk-U3X4LTN4.jsView on unpkg · L415•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/chunk-U3X4LTN4.jsView on unpkgruntime/entrypoint.shView file
•path = runtime/entrypoint.sh
kind = build_helper
sizeBytes = 436
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
runtime/entrypoint.shView on unpkgdist/chunk-6W6UZ4SJ.jsView file
•matchType = normalized_sha256
matchedPackage = @rallycry/conveyor-agent@11.0.11
matchedPath = dist/chunk-6W6UZ4SJ.js
matchedIdentity = npm:[redacted]:11.0.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-6W6UZ4SJ.jsView on unpkgFindings
2 Critical6 High4 Medium5 Low
CriticalPersistence Backdoordist/boot-3FWYGHSN.js
CriticalTrigger Reachable Dangerous Capabilitydist/boot-3FWYGHSN.js
HighChild Processdist/boot-3FWYGHSN.js
HighShell
HighCross File Remote Execution Contextdist/chunk-U3X4LTN4.js
HighTrigger Reachable Persistencedist/boot-3FWYGHSN.js
HighSemantic Analysis Limiteddist/chunk-U3X4LTN4.js
HighKnown Malware Source Similaritydist/chunk-6W6UZ4SJ.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperruntime/entrypoint.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @rallycry/conveyor-agent@11.1.2.
See all versions of @rallycry/conveyor-agent for other recorded verdicts.
- Review the evidence and your use of @rallycry/conveyor-agent@11.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.