registry / Credential exfiltration / @readystack/cron-schedule-lint
@readystack/cron-schedule-lint
Not affiliated with ReadyStack (readystack.dev). No new versions are published here.
Names every schedule line in the file you have open that fires at the wrong hour, twice, or never at all - and prints the next three times each one really fires, in the zone that actually applies.
This report shows the evidence for @readystack/cron-schedule-lint@0.1.6. 1 of 8 known versions is blocked or flagged. The newest version, 0.1.9, is allowed. See all versions.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe inspected source establishes an automatic transfer of a Polar license credential to a package-selected host. The transfer is gated by key availability and cache age, but not by recipient-specific consent.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the CLI with a license key in the environment or saved license state, when the feed cache is stale.
Impact
The license credential is disclosed to a recipient other than the Polar license-validation service.
Mechanism
The CLI calls the feed helper at startup; that helper places the key in a request to getreadystack.com.
Attack narrative
On CLI startup, the package checks its rules feed before handling the requested command. When a license key is available and the feed cache is stale, it sends the key to getreadystack.com, although the key is validated by api.polar.sh. This exposes the license credential to a separate recipient without a recipient-specific consent gate.
AI rationale
The inspected source establishes an automatic transfer of a Polar license credential to a package-selected host. The transfer is gated by key availability and cache age, but not by recipient-specific consent.
Evidence
cli.jslicense.js
Network endpoints2
api.polar.sh/v1/customer-portal/license-keys/validategetreadystack.com/api/rules/
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The published command starts the CLI, which requests the rules feed before processing any command-line options.
- The feed request takes the license key from the environment or saved state, and proceeds when a key exists and the feed cache is stale.
- The package sends that key in a query string to getreadystack.com; its license validator uses the key for api.polar.sh.
- A successful license validation saves the key for later use.
Evidence against
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggedlicense.jsView file
2'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L31: req.on('error', function () { resolve({ ok: false, offline:
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
license.jsView on unpkg · L22Trigger-reachable chain: manifest.bin -> cli.js -> license.js
L2: 'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L31
Findings
3 Critical2 High3 Medium4 Low
CriticalCredential Exfiltrationlicense.js
CriticalTrigger Reachable Dangerous Capabilitylicense.js
CriticalPrevious Version Dangerous Deltacli.js
HighSandbox Evasion Gated Capabilitylicense.js
HighTrigger Reachable Credential Exfiltrationlicense.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @readystack/cron-schedule-lint@0.1.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing @readystack/cron-schedule-lint@0.1.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.