Loading npm security reports…

keyring-agent-core@0.2.42: Suspicious npm security report (Warn) | LPM Firewall

registry / keyring-agent-core / 0.2.42

keyring-agent-core@0.2.42

Core AI chat agent with multi-agent architecture, ReAct pattern, and modular tool system powered by Gemini

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.51 MB of source, external domains: 1rpc.io, apac.smith.langchain.com, api.coingecko.com, api.coinpool.app, api.relay.link, api.smith.langchain.com, app.uniswap.org, arb1.arbitrum.io, arbiscan.io, arbitrum-one-rpc.publicnode.com, arbitrum.drpc.org, avalanche-c-chain-rpc.publicnode.com, avalanche.drpc.org, aws.smith.langchain.com, base-rpc.publicnode.com, base.drpc.org, basescan.org, beta.smith.langchain.com, bsc-dataseed.binance.org, bsc-rpc.publicnode.com, bsc.drpc.org, bscscan.com, coinpool-api-op.bacoor-test001.xyz, coinpool.app, dev.smith.langchain.com, dln.debridge.finance, docs.langchain.com, eth.drpc.org, ethereum-rpc.publicnode.com, etherscan.io, eu.smith.langchain.com, exchange-api.keyring.app, gateway.thegraph.com, github.com, gnosis-rpc.publicnode.com, gnosis.drpc.org, gnosisscan.io, hyperevmscan.io, interface.gateway.uniswap.org, json-schema.org, keyring.app, linea-rpc.publicnode.com, linea.drpc.org, lineascan.build, mainnet.base.org, mainnet.optimism.io, mantle-rpc.publicnode.com, mantlescan.xyz, monadscan.com, nft.keyring.app

Source & flagged code

4 flagged · loading source

dist/index.native.jsView file

662L663: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),u=[];for(let c of l)c.index>=0&&c.index<th... L664:

High

Child Process

Package source references child process execution.

dist/index.native.jsView on unpkg · L662

662L663: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),u=[];for(let c of l)c.index>=0&&c.index<th... L664:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.native.jsView on unpkg · L662

1if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol... L2: "use strict";var tJ=Object.create;var Hh=Object.defineProperty;var rJ=Object.getOwnPropertyDescriptor;var nJ=Object.getOwnPropertyNames;var iJ=Object.getPrototypeOf,oJ=Object.proto... L3: L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/ L5: `);super(n);f(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},eC=class extends vo{get is_bubble_up(){return!0}},gre=class extends vo{constructor(t,e){super(t,e),this.na... L6: L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/ L8: `,t}var Bm=Bie.ns.sub("error"),fw=class extends Bm.brand(Err

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.native.jsView on unpkg · L1

1if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol... L2: "use strict";var tJ=Object.create;var Hh=Object.defineProperty;var rJ=Object.getOwnPropertyDescriptor;var nJ=Object.getOwnPropertyNames;var iJ=Object.getPrototypeOf,oJ=Object.proto... L3: L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/ L5: `);super(n);f(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},eC=class extends vo{get is_bubble_up(){return!0}},gre=class extends vo{constructor(t,e){super(t,e),this.na... L6: L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/ L8: `,t}var Bm=Bie.ns.sub("error"),fw=class extends Bm.brand(Err

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.native.jsView on unpkg · L1

Source & flagged code

4 flagged

dist/index.native.jsView file

662L663: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),u=[];for(let c of l)c.index>=0&&c.index<th... L664:

High

Child Process

Package source references child process execution.

dist/index.native.jsView on unpkg · L662

662L663: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),u=[];for(let c of l)c.index>=0&&c.index<th... L664:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.native.jsView on unpkg · L662

1if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol... L2: "use strict";var tJ=Object.create;var Hh=Object.defineProperty;var rJ=Object.getOwnPropertyDescriptor;var nJ=Object.getOwnPropertyNames;var iJ=Object.getPrototypeOf,oJ=Object.proto... L3: L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/ L5: `);super(n);f(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},eC=class extends vo{get is_bubble_up(){return!0}},gre=class extends vo{constructor(t,e){super(t,e),this.na... L6: L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/ L8: `,t}var Bm=Bie.ns.sub("error"),fw=class extends Bm.brand(Err

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.native.jsView on unpkg · L1

1if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol... L2: "use strict";var tJ=Object.create;var Hh=Object.defineProperty;var rJ=Object.getOwnPropertyDescriptor;var nJ=Object.getOwnPropertyNames;var iJ=Object.getPrototypeOf,oJ=Object.proto... L3: L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/ L5: `);super(n);f(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},eC=class extends vo{get is_bubble_up(){return!0}},gre=class extends vo{constructor(t,e){super(t,e),this.na... L6: L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/ L8: `,t}var Bm=Bie.ns.sub("error"),fw=class extends Bm.brand(Err

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.native.jsView on unpkg · L1