registry / Remote code execution / @funny-booth/agent-core
@funny-booth/agent-core
AIエージェント起動CLI（共有ランチャー + MCPサーバー）
This report shows the evidence for @funny-booth/agent-core@0.1.14. 13 of 37 known versions are blocked or flagged. The newest version, 0.1.41, is flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package creates concrete remote code execution and credential exposure paths when its user-facing commands run. Obfuscation and silent global self-updating further remove meaningful user control.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs any salesbot bin command or starts the MCP server and invokes its remote-backed tool.
Impact
A portal-controlled package or command can execute locally with supplied credentials and access the user's environment.
Mechanism
Obfuscated remote package loading, token and secret forwarding, and portal-directed command execution.
Attack narrative
A user launches a salesbot binary, which calls the obfuscated launcher. The launcher authenticates to the configured portal, fetches MCP definitions, and writes a Claude MCP configuration that runs each returned package through npx. It provides those packages the portal token and values from the local secret vault. Separately, the MCP server fetches a portal-provided command and executes it. These remote-controlled execution paths are concealed by obfuscation and are not limited to a fixed, reviewed dependency set.
AI rationale
The package creates concrete remote code execution and credential exposure paths when its user-facing commands run. Obfuscation and silent global self-updating further remove meaningful user control.
Evidence
dist/bin/salesbot7.jsdist/launcher.jsdist/index.jslauncher.config.json~/.<toolName>/secrets.enc~/.<toolName>/vault.key
Network endpoints1
app.ai-agentos.jp
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The published runtime files are deliberately obfuscated, concealing security-sensitive behavior.
- Each salesbot command invokes the launcher, which fetches portal-selected MCP packages and configures them to run through npx.
- The launcher passes its portal token and locally stored secrets into those remotely selected packages.
- An MCP tool accepts a command returned by the portal and executes it with child_process.
- The launcher checks for updates and silently starts a detached global npm installation.
Evidence against
- There is no npm install lifecycle hook; prepublishOnly runs only when publishing.
- The configured portal host is explicit in launcher.config.json.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedObfuscated
Source & flagged code
6 flagged · loading sourcedist/bin/salesbot7.jsView file
2// AUTO-GENERATED by scripts/generate-bins.mjs — do not edit
L3: require("../launcher.js").runLauncher(7).catch((e) => {
L4: process.stderr.write(String((e && e.stack) || e) + "\n");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/bin/salesbot7.jsView on unpkg · L2dist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @funny-booth/agent-core@0.1.15
matchedIdentity = npm:QGZ1bm55LWJvb3RoL2FnZW50LWNvcmU:0.1.15
similarity = 0.867
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg1#!/usr/bin/env node
L2: 'use strict';const _0x3b9409=_0xf209;(function(_0x72ae8f,_0x3227a3){const _0x1f4085=_0xf209,_0x6cb850=_0x72ae8f();while(!![]){try{const _0x103c24=-parseInt(_0x1f4085(0x93))/0x1*(pa...
Findings
1 Critical5 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/launcher.js#virtual:normalized:round1
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/launcher.js#virtual:normalized:round1
HighObfuscated
MediumDynamic Requiredist/bin/salesbot7.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @funny-booth/agent-core@0.1.14.
The versions list below shows the verdict for each recorded version.
- Avoid installing @funny-booth/agent-core@0.1.14. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.