registry / @readystack/swift6-concurrency-lint / 1.0.3
@readystack/swift6-concurrency-lint@1.0.3
Not affiliated with ReadyStack (readystack.dev). No new versions are published here. These tools continue under the name Rulestamp, by the team behind getreadystack.com.
11 rules that name the .swift lines Swift 6 language mode rejects — 13 findings, 6 build-blocking, on the 47-line fixture
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged credential and network behavior is attributable to license validation and the package’s own rule service; the telemetry event contains limited product-use fields and has opt-outs. The inspected CLI and license flows do not show unrelated credential collection or exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the CLI; usage telemetry is limited to interactive CLI/MCP sessions, and license requests occur when a license is used or paid functionality is requested.
Impact
No credential theft or unrelated data collection was found in the inspected flows.
Mechanism
It checks license keys with Polar, fetches licensed rule data from Readystack, and may send an event containing the package slug, source, and reason.
AI rationale
The flagged credential and network behavior is attributable to license validation and the package’s own rule service; the telemetry event contains limited product-use fields and has opt-outs. The inspected CLI and license flows do not show unrelated credential collection or exfiltration.
Evidence
~/.config/readystack/swift6-concurrency-lint.json
Network endpoints2
api.polar.shgetreadystack.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes `cli.js` as the command entrypoint and declares no lifecycle scripts.
- The paywall event sends only the event type, package slug, CLI/MCP source, and reason; it skips CI and can be disabled with `DO_NOT_TRACK=1` or `READYSTACK_NO_TELEMETRY`.
- A supplied or stored license key is checked with Polar, the license service; a key is sent to Readystack only to retrieve the package’s rule feed.
- The downloaded feed is parsed as JSON rules and merged into the linter’s rule list; the engine compiles rule patterns as regular expressions.
Evidence against
- The CLI performs network requests for license validation, rule updates, and usage/paywall events.
- The rule feed is fetched at CLI startup when a license key is available, including a stored key.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedlicense.jsView file
2'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = '';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L31: req.on('error', function () { resolve({ ok: false, offline: true }); });
L32: req.write(body); r
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
license.jsView on unpkg · L22Trigger-reachable chain: manifest.bin -> cli.js -> license.js
L2: 'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = '';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L31: req.on('error', function () { reso
Findings
2 Critical2 High3 Medium5 Low
CriticalCredential Exfiltrationlicense.js
CriticalTrigger Reachable Dangerous Capabilitylicense.js
HighSandbox Evasion Gated Capabilitylicense.js
HighTrigger Reachable Credential Exfiltrationlicense.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @readystack/swift6-concurrency-lint@1.0.3.
See all versions of @readystack/swift6-concurrency-lint for other recorded verdicts.
- Review the evidence and your use of @readystack/swift6-concurrency-lint@1.0.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.