registry / @funny-booth/agent-core / 0.1.41
@funny-booth/agent-core@0.1.41
AIエージェント起動CLI（共有ランチャー + MCPサーバー）
AI Security Review
scanned 8h ago · by lpm-firewall-aiThe inspected source does not establish credential theft, destructive behavior, or an install-hook attack. The obfuscated runtime and automatic global update leave a concrete but unresolved execution risk, so this warrants a warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the agent-core launcher and a newer package version is available.
Impact
The update path can replace the global installation without a separate confirmation in the inspected source; the obfuscated runtime limits behavior verification.
Mechanism
The launcher starts a detached process that runs npm to install the package’s latest release globally.
AI rationale
The inspected source does not establish credential theft, destructive behavior, or an install-hook attack. The obfuscated runtime and automatic global update leave a concrete but unresolved execution risk, so this warrants a warning.
Evidence
dist/launcher.js
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes an obfuscated launcher as its executable and builds published output with an obfuscation step.
- When the launcher runs, it checks the latest package version and starts a detached process to install the latest release globally.
- The update installer invokes npm with the package name and @latest; this creates an automatic update path with unresolved execution risk.
- The feedback module sends automatic reports only for selected error codes, and the inspected dependencies show ordinary package identities and entrypoints.
Evidence against
- The manifest has only a prepublishOnly build hook; no install-time hook was found.
- The launcher update check is part of the package’s launcher functionality, and the inspected update code checks for a newer version before installing.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
5 flagged · loading sourcedist/secretValues.jsView file
7// 受け取るのは Mod（Claude Code の中のプログラム）だけで、AI や会話の記録には渡らない。
L8: const vault_1 = require("./vault");
L9: exports.REDACT_MIN = 6;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/secretValues.jsView on unpkg · L7dist/launcher.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @funny-booth/agent-core@0.1.39
matchedIdentity = npm:QGZ1bm55LWJvb3RoL2FnZW50LWNvcmU:0.1.39
similarity = 0.625
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/launcher.jsView on unpkg1'use strict';const _0x137989=_0x54ad;(function(_0x1f2346,_0x4a44d7){const _0x2d6157=_0x54ad,_0x4a8c10=_0x1f2346();while(!![]){try{const _0x1d7fb1=parseInt(_0x2d6157(0x168))/0x1+par...
Findings
1 Critical4 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/launcher.js
HighSame File Env Network Executiondist/launcher.js
HighCommand Output Exfiltrationdist/launcher.js#virtual:normalized:round1
HighObfuscated Payload Loaderdist/feedback.js
HighObfuscated
MediumDynamic Requiredist/secretValues.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to @funny-booth/agent-core@0.1.41.
See all versions of @funny-booth/agent-core for other recorded verdicts.
- Review the evidence and your use of @funny-booth/agent-core@0.1.41 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.