registry / Credential exfiltration / @readystack/audit-log-retention-lint
@readystack/audit-log-retention-lint
Not affiliated with ReadyStack (readystack.dev). No new versions are published here.
Log retention lint for Loki, CloudWatch, ILM, S3 and Kubernetes audit YAML
This report shows the evidence for @readystack/audit-log-retention-lint@1.0.1. 1 of 2 known versions is blocked or flagged. The newest version, 1.0.2, is flagged. See all versions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe CLI automatically forwards a stored or environment-provided license key to getreadystack.com as part of its rules-feed request. This is credential disclosure to the package vendor without clear user consent, so the package is malicious.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Any CLI invocation when a license key is present and the feed cache is absent or older than seven days.
Impact
The vendor receives a license credential outside the Polar license-validation request, enabling its use or exposure through the vendor endpoint and its logs.
Mechanism
Startup calls pullFeed, which reads the key and appends it to a GET query sent to getreadystack.com.
Attack narrative
At CLI startup, before command handling, the package checks for a cached rules feed. If the cache is stale or absent and a license key exists in READYSTACK_LICENSE or the saved config, it sends that key in a query string to getreadystack.com. The package separately validates the key with Polar, but the vendor-hosted feed transfer is not disclosed in the README’s license instructions.
AI rationale
The CLI automatically forwards a stored or environment-provided license key to getreadystack.com as part of its rules-feed request. This is credential disclosure to the package vendor without clear user consent, so the package is malicious.
Evidence
license.jscli.js~/.config/readystack/audit-log-retention-lint.json
Network endpoints2
getreadystack.comapi.polar.sh
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CLI fetches the rules feed before it parses or handles the requested command.
- The feed request sends READYSTACK_LICENSE or the stored license key in the query string to getreadystack.com.
- The package stores the license key in ~/.config/readystack/audit-log-retention-lint.json by default.
Evidence against
- The package is presented as an audit-log retention linter, and its CLI scans files and reports findings.
- The license key is also sent to api.polar.sh for license validation, which matches the package’s licensing purpose.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggedlicense.jsView file
2'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L31: req.on('error', function () { resolve({ ok: false, offline:
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
license.jsView on unpkg · L22Trigger-reachable chain: manifest.bin -> cli.js -> license.js
L2: 'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L31
Findings
2 Critical3 High3 Medium4 Low
CriticalCredential Exfiltrationlicense.js
CriticalTrigger Reachable Dangerous Capabilitylicense.js
HighSandbox Evasion Gated Capabilitylicense.js
HighTrigger Reachable Credential Exfiltrationlicense.js
HighAi Review Evidencecli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @readystack/audit-log-retention-lint@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @readystack/audit-log-retention-lint@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.