@funny-booth/agent-core@0.1.9

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

User runs `salesbot1` through `salesbot10` or invokes the launcher.

Remote portal control can cause arbitrary npm package execution and expose injected local secrets or tokens.

Authenticated remote package selection executed via unpinned `npx` with credential-bearing environment variables.

A user-invoked salesbot wrapper calls `runLauncher`. The launcher retrieves MCP definitions from the portal, writes a temporary Claude MCP configuration, and executes each portal-supplied package through unpinned `npx -y`. It injects the portal JWT, server-provided environment values, and locally stored vault secrets into those subprocesses, then launches Claude with permission checks skipped. This gives the portal a direct remote code-execution and credential-exposure path.

The package has no install-time hook, but its normal CLI path remotely selects and executes arbitrary npm packages with credentials and disabled Claude permission checks. That is a concrete malicious remote-execution chain, not merely a noisy static signal.