@funny-booth/agent-core@0.1.34
AIエージェント起動CLI（共有ランチャー + MCPサーバー）
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package deliberately obfuscates its published runtime, and the entrypoint imports an automatic feedback reporter whose endpoint and caller path remain unresolved. The inspected excerpts do not prove malicious behavior, so this warrants a warning rather than a block.
Decision evidence
public snapshot- The publish script explicitly obfuscates the distributed JavaScript, and the prepublishOnly hook runs that script.
- The main entrypoint imports the obfuscated feedback module, which posts a JSON body and automatically reports selected failures.
- The obfuscated strings prevent confirming the report destination, payload contents, and whether every reporting path is user-consented.
- The inspected feedback helper submits a supplied JSON body; the excerpts do not establish credential collection, a malicious payload loader, or an unrelated recipient.
Source & flagged code
3 flagged · loading sourceSource contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/feedback.jsView on unpkg · L1Package source references dynamic require/import behavior.
dist/feedback.jsView on unpkg · L1The publish script explicitly obfuscates the distributed JavaScript, and the prepublishOnly hook runs that script.
Findings
Affected versions and remediation
This report applies to @funny-booth/agent-core@0.1.34.
See all versions of @funny-booth/agent-core for other recorded verdicts.
- Review the evidence and your use of @funny-booth/agent-core@0.1.34 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.