registry / @readystack/red-doc-en18031-lint / 1.0.2
@readystack/red-doc-en18031-lint@1.0.2
Not affiliated with ReadyStack (readystack.dev). No new versions are published here. These tools continue under the name Rulestamp, by the team behind getreadystack.com.
Checks an EU declaration of conformity for radio equipment against Delegated Regulation (EU) 2022/30 and the EN 18031:2024 citations
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged credential flow sends the package's own licence key to its licensing and rule services for the advertised paid functionality. The source also discloses a limited paywall event and provides telemetry opt-outs; no unrelated credential collection or attack behavior was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
CLI startup may fetch cached or updated rules when a product licence key is available; licence-gated actions validate the key and may send a paywall event on failure.
Impact
No unauthorized credential theft, account action, or destructive behavior identified.
Mechanism
HTTPS requests go to the package vendor's rule and event endpoints and Polar's licence-validation endpoint. The paywall event contains only the product slug, source, and reason, with telemetry opt-outs.
AI rationale
The flagged credential flow sends the package's own licence key to its licensing and rule services for the advertised paid functionality. The source also discloses a limited paywall event and provides telemetry opt-outs; no unrelated credential collection or attack behavior was found.
Evidence
${READYSTACK_HOME}/red-doc-en18031-lint.json~/.config/readystack/red-doc-en18031-lint.json
Network endpoints2
api.polar.shgetreadystack.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a declaration-of-conformity linter and exposes cli.js as its command-line entry point.
- Paywall telemetry is limited to the product slug, CLI or MCP source, and reason; it has DO_NOT_TRACK and READYSTACK_NO_TELEMETRY opt-outs and only sends in a terminal or MCP session.
- The paywall event is triggered when a licence check finds no key or an invalid key.
- Licence validation sends the product licence key to api.polar.sh, and the README describes licence-gated folder scans and report generation.
- The CLI fetches paid rules from getreadystack.com using the product licence key.
Evidence against
- The source does send a paywall event to the vendor, but the event contains no host, username, file, or credential data.
- No install lifecycle scripts are declared, and the inspected code shows no unrelated credential collection or destructive behavior.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
5 flaggedlicense.jsView file
2'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L31: req.on('error', function () { resolve({ ok: false, offline:
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
license.jsView on unpkg · L22Trigger-reachable chain: manifest.bin -> cli.js -> license.js
L2: 'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L31
Findings
3 Critical1 High3 Medium5 Low
CriticalCredential Exfiltrationlicense.js
CriticalTrigger Reachable Dangerous Capabilitylicense.js
CriticalPrevious Version Dangerous Deltalicense.js
HighTrigger Reachable Credential Exfiltrationlicense.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowAi Review EvidenceREADME.md
Affected versions and remediation
This report applies to @readystack/red-doc-en18031-lint@1.0.2.
See all versions of @readystack/red-doc-en18031-lint for other recorded verdicts.
- Review the evidence and your use of @readystack/red-doc-en18031-lint@1.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.