@readystack/payroll-rate-expiry-lint@1.0.2
Not affiliated with ReadyStack (readystack.dev). No new versions are published here.
The day your rate table stopped being correct, with the line number
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe CLI automatically forwards a stored or environment-provided license key to getreadystack.com on startup, while the key is separately used for validation with api.polar.sh. This is credential disclosure to a different host without a separate user action, so publishing should be blocked.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Any CLI invocation when READYSTACK_LICENSE or a saved license key is present.
Impact
The publisher endpoint receives the license credential without a separate user action for the feed request.
Mechanism
The CLI automatically calls pullFeed(), which reads the key and adds it to a GET request query string for getreadystack.com. The key is also used for validation at api.polar.sh.
Attack narrative
On every CLI startup, the package reads the license key from the environment or its saved license file and sends it as a query parameter to getreadystack.com. The key is separately submitted to Polar for license validation, so the automatic feed request forwards that credential to another host without a distinct user action.
AI rationale
The CLI automatically forwards a stored or environment-provided license key to getreadystack.com on startup, while the key is separately used for validation with api.polar.sh. This is credential disclosure to a different host without a separate user action, so publishing should be blocked.
Evidence
license.jscli.js~/.config/readystack/payroll-rate-expiry-lint.json
Network endpoints2
getreadystack.comapi.polar.sh
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exposes cli.js as its command entry point.
- license.js loads the license key from READYSTACK_LICENSE or the local saved state.
- cli.js calls pullFeed() at the start of every command invocation.
- pullFeed() sends the key in a query string to getreadystack.com, even though license.js separately validates keys with api.polar.sh.
Evidence against
- The package’s main function is a local payroll-rate linter.
- License validation with the key is expected to contact api.polar.sh.
- The feed request fetches rules for the licensed product.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggedlicense.jsView file
2'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L31: req.on('error', function () { resolve({ ok: false, offline:
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
license.jsView on unpkg · L22Trigger-reachable chain: manifest.bin -> cli.js -> license.js
L2: 'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L31
Findings
2 Critical3 High3 Medium4 Low
CriticalCredential Exfiltrationlicense.js
CriticalTrigger Reachable Dangerous Capabilitylicense.js
HighSandbox Evasion Gated Capabilitylicense.js
HighTrigger Reachable Credential Exfiltrationlicense.js
HighAi Review Evidencepackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @readystack/payroll-rate-expiry-lint@1.0.2.
See all versions of @readystack/payroll-rate-expiry-lint for other recorded verdicts.
- Avoid installing @readystack/payroll-rate-expiry-lint@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.