@funny-booth/agent-core@0.1.18
古い版です。最新版を使ってください
AIエージェント起動CLI（共有ランチャー + MCPサーバー）
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe source shows a user-facing MCP installation capability that executes a portal-provided command, while obfuscation prevents confidently verifying its safeguards. No automatic install lifecycle attack or concrete malicious behavior was established, so this is a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An MCP installation request handled by the CLI.
Impact
If the configured portal returns an unsafe command, it could execute on the user's machine. Available source does not establish an attack or its consent safeguards.
Mechanism
The CLI sends the requested MCP identifier and supplied environment values to the portal, receives an install command, and passes it to a child-process API; a separate helper installs MCP packages through npm.
AI rationale
The source shows a user-facing MCP installation capability that executes a portal-provided command, while obfuscation prevents confidently verifying its safeguards. No automatic install lifecycle attack or concrete malicious behavior was established, so this is a warning rather than a block.
Evidence
dist/index.jsdist/mcpPackages.js
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The publish build deliberately runs an obfuscation step on the shipped code.
- The MCP install tool retrieves an install command from the authenticated portal and passes it to a child-process API.
- The MCP package manager can fetch and install a package when no local version is present; the obfuscated implementation limits verification of its safeguards.
Evidence against
- The package has no preinstall, install, or postinstall hook; its prepublishOnly script is for publishing.
- The observed install path is part of an MCP installation tool and does not by itself establish covert or unconsented execution.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedObfuscated
NoLicense
Source & flagged code
4 flagged · loading sourcedist/mcpPackages.jsView file
1'use strict';const _0x787838=_0x1029;(function(_0x1f5c98,_0x56f3fb){const _0x2c87ae=_0x1029,_0x5ca025=_0x1f5c98();while(!![]){try{const _0x532120=-parseInt(_0x2c87ae(0x218))/0x1*(-...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcpPackages.jsView on unpkg · L11'use strict';const _0x787838=_0x1029;(function(_0x1f5c98,_0x56f3fb){const _0x2c87ae=_0x1029,_0x5ca025=_0x1f5c98();while(!![]){try{const _0x532120=-parseInt(_0x2c87ae(0x218))/0x1*(-...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/mcpPackages.jsView on unpkg · L1dist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @funny-booth/agent-core@0.1.15
matchedIdentity = npm:QGZ1bm55LWJvb3RoL2FnZW50LWNvcmU:0.1.15
similarity = 0.867
summary = stored previous version shares package body but lacks this dangerous source file
Findings
1 Critical3 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighSame File Env Network Executiondist/index.js
HighObfuscated Payload Loaderdist/mcpPackages.js
HighObfuscated
MediumDynamic Requiredist/mcpPackages.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to @funny-booth/agent-core@0.1.18.
See all versions of @funny-booth/agent-core for other recorded verdicts.
- Review the evidence and your use of @funny-booth/agent-core@0.1.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.