registry / @funny-booth/agent-core / 0.1.33
@funny-booth/agent-core@0.1.33
AIエージェント起動CLI（共有ランチャー + MCPサーバー）
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe release deliberately obfuscates its published CLI and launcher, and the launcher includes update and configuration behavior that cannot be fully resolved from the inspected excerpts. This supports a warning for unresolved risk, but the inspected source does not establish concrete attack behavior for a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running the agent-core CLI or its launcher.
Impact
The obscured runtime behavior leaves unresolved risk, but the inspected excerpts do not show a specific harmful effect.
Mechanism
The launcher contains obfuscated configuration and update logic, and the CLI entrypoint is also obfuscated.
AI rationale
The release deliberately obfuscates its published CLI and launcher, and the launcher includes update and configuration behavior that cannot be fully resolved from the inspected excerpts. This supports a warning for unresolved risk, but the inspected source does not establish concrete attack behavior for a block.
Evidence
package.jsondist/index.jsdist/launcher.jsdist/feedback.js
Network endpoints1
registry.npmjs.org/
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- package.json defines a prepublishOnly build that runs an obfuscation step.
- dist/index.js, the declared CLI entrypoint, is heavily obfuscated.
- dist/launcher.js contains obfuscated launcher behavior, including MCP configuration and a detached update process.
- dist/feedback.js auto-reports some portal HTTP failures; the source does not establish that this is unrelated exfiltration.
Evidence against
- The password submission code sends prompted credentials to the configured portal URL.
- The inspected excerpts do not establish an unconsented attack or identify a concrete malicious payload.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcedist/feedback.jsView file
1'use strict';const _0x67aa2=_0x16ee;(function(_0xc418cb,_0x337e6f){const _0x4cfa87=_0x16ee,_0xbfc709=_0xc418cb();while(!![]){try{const _0x167b47=-parseInt(_0x4cfa87(0x1d1))/0x1*(-p...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/feedback.jsView on unpkg · L11'use strict';const _0x67aa2=_0x16ee;(function(_0xc418cb,_0x337e6f){const _0x4cfa87=_0x16ee,_0xbfc709=_0xc418cb();while(!![]){try{const _0x167b47=-parseInt(_0x4cfa87(0x1d1))/0x1*(-p...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/feedback.jsView on unpkg · L1dist/launcher.jsView file
1'use strict';const _0x531fdc=_0x57c2;(function(_0x1098f1,_0x425a2c){const _0x457be1=_0x57c2,_0x2f2782=_0x1098f1();while(!![]){try{const _0x3c0ac5=parseInt(_0x457be1(0x20b))/0x1*(-p...
High
Findings
1 Critical4 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighSame File Env Network Executiondist/launcher.js
HighCommand Output Exfiltrationdist/launcher.js#virtual:normalized:round1
HighObfuscated Payload Loaderdist/feedback.js
HighObfuscated
MediumDynamic Requiredist/feedback.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @funny-booth/agent-core@0.1.33.
See all versions of @funny-booth/agent-core for other recorded verdicts.
- Review the evidence and your use of @funny-booth/agent-core@0.1.33 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.