@readystack/payroll-rate-expiry-lint@1.0.4
Not affiliated with ReadyStack (readystack.dev). No new versions are published here. These tools continue under the name Rulestamp, by the team behind getreadystack.com.
The day your rate table stopped being correct, with the line number
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package performs runtime usage and paywall telemetry that is not disclosed in its README, so it merits a warning. The inspected event payloads contain product and event fields, and the license key is used with the package's licensing services; no malicious credential exfiltration was identified.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A person runs the CLI interactively, or a CLI/MCP session encounters a missing or invalid license key; CI and telemetry opt-outs suppress these events.
Impact
The vendor can observe product usage and license prompts; because the runtime telemetry is not disclosed in the README, this warrants a warning.
Mechanism
The package posts product slug, event source and reason to getreadystack.com/api/ev. The inspected telemetry does not include file contents or unrelated credentials.
AI rationale
The package performs runtime usage and paywall telemetry that is not disclosed in its README, so it merits a warning. The inspected event payloads contain product and event fields, and the license key is used with the package's licensing services; no malicious credential exfiltration was identified.
Evidence
cli.jslicense.js
Network endpoints3
getreadystack.com/api/evgetreadystack.com/api/rules/api.polar.sh/v1/customer-portal/license-keys/validate
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Interactive CLI use sends a usage event containing the product slug, source and event reason to getreadystack.com; CI and telemetry opt-out settings suppress it.
- Missing or invalid license keys can send a paywall event with the product slug, CLI/MCP source and reason; this event also has CI and telemetry opt-outs.
Evidence against
- The manifest defines a CLI entrypoint and no lifecycle scripts.
- License validation sends the supplied license key to Polar, while the rules feed uses the product's own getreadystack.com service.
- The telemetry is limited to product-use and paywall event fields; the inspected code does not send file contents or unrelated credentials.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggedlicense.jsView file
2'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L31: req.on('error', function () { resolve({ ok: false, offline:
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
license.jsView on unpkg · L22Trigger-reachable chain: manifest.bin -> cli.js -> license.js
L2: 'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L31
Findings
2 Critical2 High4 Medium4 Low
CriticalCredential Exfiltrationlicense.js
CriticalTrigger Reachable Dangerous Capabilitylicense.js
HighSandbox Evasion Gated Capabilitylicense.js
HighTrigger Reachable Credential Exfiltrationlicense.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencecli.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @readystack/payroll-rate-expiry-lint@1.0.4.
See all versions of @readystack/payroll-rate-expiry-lint for other recorded verdicts.
- Review the evidence and your use of @readystack/payroll-rate-expiry-lint@1.0.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.