@readystack/vagrantfile-eol-box-lint@1.0.0
Not affiliated with ReadyStack (readystack.dev). No new versions are published here. These tools continue under the name Rulestamp, by the team behind getreadystack.com.
6 findings in 1 file: boxes past end of support, with the date and the box to move to
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package sends runtime usage and paywall telemetry to its vendor without user-facing disclosure, although it offers environment-variable opt-outs and the payload contains only product and event labels. This supports a suspicious telemetry verdict, not a malicious one.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A free CLI run in an interactive terminal, or a failed license check in an eligible CLI or MCP session; telemetry opt-outs and CI suppress the pings.
Impact
The vendor can observe product-use and paywall events. No credential or project data is present in the telemetry payload shown.
Mechanism
The package POSTs product slug, source, and event reason to https://getreadystack.com/api/ev. A configured license key may also be sent to the vendor’s rules-feed endpoint.
AI rationale
The package sends runtime usage and paywall telemetry to its vendor without user-facing disclosure, although it offers environment-variable opt-outs and the payload contains only product and event labels. This supports a suspicious telemetry verdict, not a malicious one.
Evidence
cli.jslicense.js~/.config/readystack/vagrantfile-eol-box-lint.json (or the path configured by READYSTACK_HOME)
Network endpoints3
getreadystack.com/api/evgetreadystack.com/api/rules/api.polar.sh/v1/customer-portal/license-keys/validate
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- A free CLI run invokes the usage ping after processing files.
- The usage ping sends the product slug, CLI source, and a fixed “free” reason to getreadystack.com.
- The ping can be disabled with DO_NOT_TRACK=1 or READYSTACK_NO_TELEMETRY; CI runs skip it.
- When a license key is configured, startup may request the product rules feed with that key in the URL.
Evidence against
- The telemetry payloads contain product and event labels, not credentials, file contents, paths, or environment values.
- The license key is sent to the package vendor’s rules service for the documented licensed feature.
- The package’s stated purpose is linting Vagrant box references, and its engine checks text against end-of-support rules.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggedlicense.jsView file
2'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L31: req.on('error', function () { resolve({ ok: false, offline:
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
license.jsView on unpkg · L22Trigger-reachable chain: manifest.bin -> cli.js -> license.js
L2: 'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L31
Findings
2 Critical2 High4 Medium4 Low
CriticalCredential Exfiltrationlicense.js
CriticalTrigger Reachable Dangerous Capabilitylicense.js
HighSandbox Evasion Gated Capabilitylicense.js
HighTrigger Reachable Credential Exfiltrationlicense.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencecli.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @readystack/vagrantfile-eol-box-lint@1.0.0.
See all versions of @readystack/vagrantfile-eol-box-lint for other recorded verdicts.
- Review the evidence and your use of @readystack/vagrantfile-eol-box-lint@1.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.