registry / Credential exfiltration / keyring-agent-core
keyring-agent-core
Core AI chat agent with multi-agent architecture, ReAct pattern, and modular tool system powered by Gemini
This report shows the evidence for keyring-agent-core@0.2.63. 1 of 29 known versions is blocked or flagged. The newest version, 0.3.22, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe main runtime bundle contains a hard-coded authenticated external data store that receives configured KB content. Although it is not install-time behavior and requires vector-KB enablement, the undisclosed credentialed fallback creates a concrete exfiltration path.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Consumer enables vectorKB; autoIngest additionally runs on chat execution.
Impact
Configured knowledge-base content can be exfiltrated to an undeclared third-party endpoint; the package also exposes its remote-store credential.
Mechanism
Hard-coded authenticated vector-store fallback uploads configured KB data.
Attack narrative
A consumer enabling the advertised vector-KB feature without supplying both endpoint and token is silently routed to a hard-coded Upstash Vector service using a bundled credential. The implementation uploads question, answer, and metadata fields, and optional auto-ingest performs this upload while handling chat activity. This is a concrete remote data-transfer path rather than an inert dependency artifact.
AI rationale
The main runtime bundle contains a hard-coded authenticated external data store that receives configured KB content. Although it is not install-time behavior and requires vector-KB enablement, the undisclosed credentialed fallback creates a concrete exfiltration path.
Evidence
package.jsondist/index.jsdist/index.native.js
Network endpoints1
perfect-octopus-59684-us1-vector.upstash.io
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- Main bundle hard-codes an Upstash Vector endpoint and bundled fallback credential.
- When vector KB is enabled without caller credentials, runtime selects those hard-coded defaults.
- Knowledge-base question/answer metadata is upserted to that remote index.
- autoIngest can send configured KB entries during chat execution.
Evidence against
- No preinstall, install, or postinstall lifecycle hook; prepublishOnly is publish-time.
- The metadata-address signals in the native bundle are SSRF denylist checks, not metadata requests.
- Vector-KB activation requires explicit vectorKB.enabled configuration.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flagged · loading sourcedist/index.native.jsView file
675L676: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th...
L677:
High
Child Process
Package source references child process execution.
dist/index.native.jsView on unpkg · L675675L676: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th...
L677:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.native.jsView on unpkg · L6751if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol...
L2: "use strict";var Ere=Object.create;var jg=Object.defineProperty;var Cre=Object.getOwnPropertyDescriptor;var xre=Object.getOwnPropertyNames;var Ire=Object.getPrototypeOf,Ore=Object....
L3:
L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/
L5: `);super(n);f(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},WO=class extends Bo{get is_bubble_up(){return!0}},zce=class extends Bo{constructor(t,e){super(t,e),this.na...
L6:
L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/
L8: `,t}var t_=mpe.ns.sub("error"),ak=class extends t_.brand(Err
Findings
1 Critical5 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.native.js
HighSame File Env Network Executiondist/index.native.js
HighCloud Metadata Accessdist/index.native.js
HighObfuscated Payload Loaderdist/index.native.js
HighSemantic Analysis Limiteddist/index.native.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to keyring-agent-core@0.2.63.
The versions list below shows the verdict for each recorded version.
- Avoid installing keyring-agent-core@0.2.63. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.