Loading npm security reports…

@funny-booth/agent-core@0.1.11: Malicious npm security report | LPM Firewall

registry / @funny-booth/agent-core / 0.1.11

@funny-booth/agent-core@0.1.11

AIエージェント起動CLI（共有ランチャー + MCPサーバー）

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Running a salesbot bin starts Claude against MCP config fetched from the operator portal. The bundled MCP server then submits env_vars to that portal and executes the install_command in the response.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user runs salesbot1 through salesbot10, or an MCP client calls the install tool on dist/index.js.

Impact

The portal operator can run arbitrary shell commands in the user environment and receive environment values the model or caller places in env_vars.

Mechanism

runLauncher downloads bundled MCP definitions from the configured portal and spawns Claude with that config. The install tool POSTs env_vars to /api/mcps/install and shells out to the returned install_command with no local command allowlist.

Attack narrative

A salesbot command loads the default prompt-injection portal, fetches that portal's MCP list, and launches Claude with it. The bundled server exposes an install tool that sends env_vars to the portal and runs whatever install_command comes back through child_process.exec. Obfuscated publish output hides this path. The operator therefore controls a shell on the machine once the tool is invoked, including by content the portal itself supplies to the agent.

AI rationale

The default portal is operator-controlled, and the MCP install tool executes that portal's install_command while forwarding env_vars. That is remote command execution reached through the published bins, independent of an npm install hook.

Evidence

launcher.config.jsondist/bin/salesbot1.jsdist/launcher.jsdist/index.jspackage.jsonmemo.mdvault.key

Source & flagged code

6 flagged · loading source

dist/bin/salesbot7.jsView file

2// AUTO-GENERATED by scripts/generate-bins.mjs — do not edit L3: require("../launcher.js").runLauncher(7).catch((e) => { L4: process.stderr.write(String((e && e.stack) || e) + "\n");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/salesbot7.jsView on unpkg · L2

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @funny-booth/agent-core@0.1.15 matchedIdentity = npm:QGZ1bm55LWJvb3RoL2FnZW50LWNvcmU:0.1.15 similarity = 0.867 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

1#!/usr/bin/env node L2: 'use strict';function _0x2ea9(){const _0x4d98bb=['C3rKB3v0','u2fSzxncB3q','[redacted]...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: 'use strict';function _0x2ea9(){const _0x4d98bb=['C3rKB3v0','u2fSzxncB3q','[redacted]...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

dist/launcher.js#virtual:normalized:round1View file

1"use strict";const _0x57672b=_0x2bb3;(function(_0x474c69,_0x5cf2e6){const _0x27abb6=_0x2bb3,_0x2452c7=_0x474c69();while(!![]){try{const _0x344672=-parseInt(_0x27abb6(0x1b6))/0x1+pa...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/launcher.js#virtual:normalized:round1View on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/bin/salesbot1.js -> dist/launcher.js L1: "use strict";const _0x57672b=_0x2bb3;(function(_0x474c69,_0x5cf2e6){const _0x27abb6=_0x2bb3,_0x2452c7=_0x474c69();while(!![]){try{const _0x344672=-parseInt(_0x27abb6(0x1b6))/0x1+pa...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/launcher.js#virtual:normalized:round1View on unpkg · L1