registry / @funny-booth/agent-core / 0.1.16
@funny-booth/agent-core@0.1.16
古い版です。最新版を使ってください
AIエージェント起動CLI（共有ランチャー + MCPサーバー）
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe inspected source shows no malicious behavior: login targets the configured product portal, and remote command execution is tied to an explicit MCP installation request. The generated code is obfuscated, which limits auditability, but that alone does not establish an attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The launcher runs when invoked by the user; the install command runs only when the user calls install_mcp.
Impact
The inspected source does not establish an unrelated credential recipient or automatic install-time command execution.
Mechanism
Login credentials are sent to the configured portal, whose shipped default is app.ai-agentos.jp. The install_mcp handler runs a command returned by that portal after a successful response.
AI rationale
The inspected source shows no malicious behavior: login targets the configured product portal, and remote command execution is tied to an explicit MCP installation request. The generated code is obfuscated, which limits auditability, but that alone does not establish an attack.
Evidence
package.jsonlauncher.config.jsondist/launcher.jsdist/index.js
Network endpoints2
app.ai-agentos.jpregistry.npmjs.org/
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json points the CLI and main entry to dist files; its scripts show prepublishOnly build work and no install hook.
- The launcher sends prompted login credentials to its configured portal; the shipped portal is app.ai-agentos.jp.
- MCP installation is an explicitly registered tool, and its handler executes the portal-returned command after a successful API response.
Evidence against
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcedist/bin/salesbot7.jsView file
2// AUTO-GENERATED by scripts/generate-bins.mjs — do not edit
L3: require("../launcher.js").runLauncher(7).catch((e) => {
L4: process.stderr.write(String((e && e.stack) || e) + "\n");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/bin/salesbot7.jsView on unpkg · L2dist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @funny-booth/agent-core@0.1.27
matchedIdentity = npm:QGZ1bm55LWJvb3RoL2FnZW50LWNvcmU:0.1.27
similarity = 0.800
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg1#!/usr/bin/env node
L2: 'use strict';function _0x2b00(_0x46bbda,_0x1d8d69){_0x46bbda=_0x46bbda-0x79;const _0x29a8a4=_0x29a8();let _0x2b0013=_0x29a8a4[_0x46bbda];if(_0x2b00['eGMuBG']===undefined){var _0xdd...
Findings
1 Critical5 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js#virtual:normalized:round1
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js#virtual:normalized:round1
HighObfuscated
MediumDynamic Requiredist/bin/salesbot7.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @funny-booth/agent-core@0.1.16.
See all versions of @funny-booth/agent-core for other recorded verdicts.
- Review the evidence and your use of @funny-booth/agent-core@0.1.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.