registry / Credential exfiltration / @readystack/cbpr-address-lint
@readystack/cbpr-address-lint
Not affiliated with ReadyStack (readystack.dev). No new versions are published here.
Find the ISO 20022 postal addresses your correspondent bank will repair by hand, before you send the message
This report shows the evidence for @readystack/cbpr-address-lint@1.0.2. 1 of 5 known versions is blocked or flagged. The newest version, 1.0.4, is allowed. See all versions.
AI Security Review
scanned 12d ago · by lpm-firewall-aiOn CLI startup, the package automatically forwards a stored or environment-provided license credential to a fixed publisher endpoint when the feed cache is stale or absent. This unconsented credential transfer supports blocking publication.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the CLI when a saved or READYSTACK_LICENSE key exists and the feed cache is missing or older than seven days.
Impact
The publisher endpoint receives the license credential, creating a risk of unauthorized use.
Mechanism
The startup feed request includes the key as a query parameter to a fixed getreadystack.com endpoint.
Attack narrative
The package command starts cli.js, which calls the feed helper before handling its arguments. When the feed cache is absent or stale and a saved or environment-provided license key is available, the helper sends that key to the publisher’s fixed rules endpoint. The key is also used for license validation through Polar; the source shows no recipient-specific consent for forwarding it to the publisher endpoint.
AI rationale
On CLI startup, the package automatically forwards a stored or environment-provided license credential to a fixed publisher endpoint when the feed cache is stale or absent. This unconsented credential transfer supports blocking publication.
Evidence
package.jsoncli.jslicense.js
Network endpoints2
getreadystack.com/api/rules/api.polar.sh
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exposes cli.js as its command-line entrypoint.
- The CLI requests the license feed before processing command-line arguments.
- License keys are sent to Polar for validation and saved locally after validation.
- When a saved or environment-provided key is present and the feed cache is stale or absent, the feed request sends that key to a fixed publisher endpoint.
Evidence against
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggedlicense.jsView file
2'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L31: req.on('error', function () { resolve({ ok: false, offline:
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
license.jsView on unpkg · L22Trigger-reachable chain: manifest.bin -> cli.js -> license.js
L2: 'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L31
Findings
2 Critical3 High3 Medium4 Low
CriticalCredential Exfiltrationlicense.js
CriticalTrigger Reachable Dangerous Capabilitylicense.js
HighSandbox Evasion Gated Capabilitylicense.js
HighTrigger Reachable Credential Exfiltrationlicense.js
HighSemantic Analysis Limitedengine.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @readystack/cbpr-address-lint@1.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing @readystack/cbpr-address-lint@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.