@readystack/lockfile-due-diligence-lint@1.0.1
Not affiliated with ReadyStack (readystack.dev). No new versions are published here. These tools continue under the name Rulestamp, by the team behind getreadystack.com.
npm install scripts, integrity and sources under EU CRA Art. 13(5)
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package performs runtime telemetry to its own service without describing it in the README, so the telemetry disclosure rule makes this suspicious. The reviewed events contain only product and event context, while licence-key requests go to the package’s stated licensing service; I found no unrelated credential exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
An interactive free CLI scan, or a paid check that encounters a missing or invalid licence in an eligible terminal or MCP session.
Impact
The vendor can observe eligible package usage and paywall events. The reviewed payloads do not include scanned files or unrelated credentials.
Mechanism
The package sends small use or paywall events to getreadystack.com; DO_NOT_TRACK=1, READYSTACK_NO_TELEMETRY, or CI disables these events.
AI rationale
The package performs runtime telemetry to its own service without describing it in the README, so the telemetry disclosure rule makes this suspicious. The reviewed events contain only product and event context, while licence-key requests go to the package’s stated licensing service; I found no unrelated credential exfiltration.
Evidence
cli.jslicense.js
Network endpoints1
getreadystack.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Interactive free CLI use sends a usage event containing the tool slug, CLI source, and a free-use reason to getreadystack.com.
- The usage event is sent after a free scan without an explicit telemetry opt-in; the code provides opt-out environment variables.
- When a paid check needs a licence, the package also sends a paywall event with the slug, source, and reason.
- The package’s licence feed uses the package’s own READYSTACK_LICENSE or stored licence key and contacts the vendor’s getreadystack.com service.
Evidence against
- The telemetry payloads shown contain event labels and product context, not file contents, environment values, or unrelated credentials.
- The README describes the licence requirement and setting READYSTACK_LICENSE; sending that package-specific key to the vendor’s licensing/feed service matches the stated purpose.
- No install lifecycle scripts are declared, and the linter’s scan behavior matches its stated purpose.
Behavioral surface
EnvironmentVarsFilesystemNetwork
Source & flagged code
5 flaggedlicense.jsView file
2'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L33: req.on('error', function () { resolve({ ok: false, offline:
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
license.jsView on unpkg · L22Trigger-reachable chain: manifest.bin -> cli.js -> license.js
L2: 'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L33
Findings
2 Critical2 High4 Medium4 Low
CriticalCredential Exfiltrationlicense.js
CriticalTrigger Reachable Dangerous Capabilitylicense.js
HighSandbox Evasion Gated Capabilitylicense.js
HighTrigger Reachable Credential Exfiltrationlicense.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencecli.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @readystack/lockfile-due-diligence-lint@1.0.1.
See all versions of @readystack/lockfile-due-diligence-lint for other recorded verdicts.
- Review the evidence and your use of @readystack/lockfile-due-diligence-lint@1.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.