registry / @funny-booth/agent-core / 0.1.25
@funny-booth/agent-core@0.1.25
古い版です。最新版を使ってください
AIエージェント起動CLI（共有ランチャー + MCPサーバー）
AI Security Review
scanned 9d ago · by lpm-firewall-aiSource inspection found obfuscated code and an automatic self-update, but no concrete attack chain. The credential flow is an interactive login to the configured portal, and the package has no install lifecycle hook.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running a published CLI entrypoint starts the launcher and its normal login and MCP flows.
Impact
No unrelated credential disclosure, command-output exfiltration, or install-time consumer mutation was established.
Mechanism
Observed network behavior authenticates to the configured portal, sends error metadata through the feedback path, or checks npm for a newer release of this package.
AI rationale
Source inspection found obfuscated code and an automatic self-update, but no concrete attack chain. The credential flow is an interactive login to the configured portal, and the package has no install lifecycle hook.
Evidence
package.jsonlauncher.config.jsondist/launcher.jsdist/index.jsdist/feedback.js
Network endpoints2
app.ai-agentos.jpregistry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json exposes CLI entrypoints and has a prepublishOnly build script, with no install lifecycle hook.
- The bundled launcher config points to the package’s portal; login prompts for user credentials and posts them to that configured portal.
- The launcher’s credential callers use the portal login, token refresh, and slot resolution flow; no transfer to an unrelated recipient was established.
- Feedback reporting is guarded by response status and sends tool and error metadata, not command output.
- The launcher checks npm for a newer version and then installs this package globally; this is a package self-update path.
Evidence against
- The published JavaScript is heavily obfuscated, which reduces readability.
- The launcher performs a detached global update when a newer release is found.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
6 flagged · loading sourcedist/feedback.jsView file
1'use strict';const _0x1de142=_0x1a86;function _0x1a86(_0x100b75,_0x1499bc){_0x100b75=_0x100b75-0xc8;const _0xea19ed=_0xea19();let _0x1a86c5=_0xea19ed[_0x100b75];if(_0x1a86['ONHVXf'...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/feedback.jsView on unpkg · L11'use strict';const _0x1de142=_0x1a86;function _0x1a86(_0x100b75,_0x1499bc){_0x100b75=_0x100b75-0xc8;const _0xea19ed=_0xea19();let _0x1a86c5=_0xea19ed[_0x100b75];if(_0x1a86['ONHVXf'...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/feedback.jsView on unpkg · L1dist/launcher.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @funny-booth/agent-core@0.1.24
matchedIdentity = npm:QGZ1bm55LWJvb3RoL2FnZW50LWNvcmU:0.1.24
similarity = 0.778
summary = stored previous version shares package body but lacks this dangerous source file
Findings
1 Critical5 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/launcher.js
HighSame File Env Network Executiondist/launcher.js
HighCommand Output Exfiltrationdist/launcher.js#virtual:normalized:round1
HighObfuscated Payload Loaderdist/feedback.js
HighTrigger Reachable Command Output Exfiltrationdist/launcher.js#virtual:normalized:round1
HighObfuscated
MediumDynamic Requiredist/feedback.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to @funny-booth/agent-core@0.1.25.
See all versions of @funny-booth/agent-core for other recorded verdicts.
- Review the evidence and your use of @funny-booth/agent-core@0.1.25 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.