registry / Credential exfiltration / @readystack/base-image-eol-lint
@readystack/base-image-eol-lint
Not affiliated with ReadyStack (readystack.dev). No new versions are published here.
Marks every base image in your Dockerfiles, compose files and CI workflows whose security patches have already stopped - or stop before 13 November 2026 - and prints the tag that replaces it.
This report shows the evidence for @readystack/base-image-eol-lint@0.1.6. 1 of 8 known versions is blocked or flagged. The newest version, 0.1.9, is allowed. See all versions.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe active CLI path automatically discloses a stored or environment-provided licence key to the publisher's endpoint. This is concrete credential exfiltration and supports blocking publication.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the base-image-eol-lint command with a key in READYSTACK_LICENSE or saved licence state.
Impact
The publisher-controlled endpoint receives the licence key without a recipient-specific consent step.
Mechanism
Startup calls pullFeed, which places the key in a request URL to getreadystack.com.
Attack narrative
The package command starts by retrieving its rules feed before handling the requested command. If a licence key is available from the environment or saved state, the feed request includes that key in its URL to getreadystack.com. The source shows no recipient-specific consent gate for this transfer.
AI rationale
The active CLI path automatically discloses a stored or environment-provided licence key to the publisher's endpoint. This is concrete credential exfiltration and supports blocking publication.
Evidence
package.jsoncli.jslicense.js
Network endpoints1
getreadystack.com/api/rules/
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exposes cli.js as its command-line entrypoint.
- On startup, cli.js calls pullFeed before processing command-line arguments.
- pullFeed reads the licence key from READYSTACK_LICENSE or saved state.
- pullFeed sends that key as a query parameter to getreadystack.com without a recipient-specific consent check.
Evidence against
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggedlicense.jsView file
2'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L31: req.on('error', function () { resolve({ ok: false, offline:
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
license.jsView on unpkg · L22Trigger-reachable chain: manifest.bin -> cli.js -> license.js
L2: 'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L31
Findings
3 Critical2 High3 Medium4 Low
CriticalCredential Exfiltrationlicense.js
CriticalTrigger Reachable Dangerous Capabilitylicense.js
CriticalPrevious Version Dangerous Deltacli.js
HighSandbox Evasion Gated Capabilitylicense.js
HighTrigger Reachable Credential Exfiltrationlicense.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @readystack/base-image-eol-lint@0.1.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing @readystack/base-image-eol-lint@0.1.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.