Skip to content

v1.0.1 — a safer canary "detonation" sandbox

Choose a tag to compare

@adamsjack711-ux adamsjack711-ux released this 12 Jul 18:10

In plain terms: pkgxray normally inspects a package without running it. The optional pkgxray canary command is the one exception — you opt in, and it actually runs a package's install scripts inside a locked room to watch what they do. The room is seeded with fake passwords, and all network traffic is routed into a recorder that never lets it out — so if a package tries to steal a secret and phone home, we catch it red-handed.

This release makes that locked room genuinely locked. A review found several ways a sneaky package could slip out or hide; this closes them. Only the opt-in canary command is affected — nothing else changes.

What got safer

  • Catches disguised secret theft. We used to only spot a stolen fake password if it was sent as-is; if the package scrambled it first (base64/hex), we missed it. Now we check the common disguises too.
  • The room actually blocks the internet (macOS). A package could previously open its own direct connection and sneak data out around our recorder. On macOS that escape route is now blocked at the operating-system level, while the internal recorder stays reachable.
  • Your real secrets are hidden (Linux). The sandbox used to leave your actual ~/.aws, ~/.ssh, and ~/.npmrc readable. Now they're hidden behind an empty folder — the package only ever sees the fakes.
  • A runaway package can't wreck the machine. The tested code now runs with limits on CPU time, file size, and crash dumps.

What got fixed

  • A package can no longer freeze the scan by holding a network connection open forever.
  • A clean result is now labelled honestly. Watching a package once can only catch bad behaviour, never prove it's safe (clever malware stays quiet when it senses it's watched). So a clean run now says not-observed ("we didn't see anything this time") instead of safe. The normal, non-canary scan is unchanged.
  • Odd folder names can't break the sandbox rules (paths are now escaped safely).

Full notes: CHANGELOG.md. Published to npm with build provenance.