keyring-agent-core@0.2.60: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

keyring-agent-core@0.2.60: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/index.native.jsView file

675L676: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th... L677:

High

Child Process

Package source references child process execution.

dist/index.native.jsView on unpkg · L675

675L676: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th... L677:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.native.jsView on unpkg · L675

1if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol... L2: "use strict";var yre=Object.create;var qg=Object.defineProperty;var _re=Object.getOwnPropertyDescriptor;var bre=Object.getOwnPropertyNames;var vre=Object.getPrototypeOf,wre=Object.... L3: L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/ L5: `);super(n);h(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},zO=class extends Fo{get is_bubble_up(){return!0}},Mce=class extends Fo{constructor(t,e){super(t,e),this.na... L6: L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/ L8: `,t}var e_=spe.ns.sub("error"),rT=class extends e_.brand(Err

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.native.jsView on unpkg · L1

1if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol... L2: "use strict";var yre=Object.create;var qg=Object.defineProperty;var _re=Object.getOwnPropertyDescriptor;var bre=Object.getOwnPropertyNames;var vre=Object.getPrototypeOf,wre=Object.... L3: L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/ L5: `);super(n);h(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},zO=class extends Fo{get is_bubble_up(){return!0}},Mce=class extends Fo{constructor(t,e){super(t,e),this.na... L6: L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/ L8: `,t}var e_=spe.ns.sub("error"),rT=class extends e_.brand(Err

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.native.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.native.jsView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = keyring-agent-core@0.2.58 matchedIdentity = npm:a2V5cmluZy1hZ2VudC1jb3Jl:0.2.58 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

6 flagged

dist/index.native.jsView file

675L676: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th... L677:

High

Child Process

Package source references child process execution.

dist/index.native.jsView on unpkg · L675

675L676: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th... L677:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.native.jsView on unpkg · L675

1if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol... L2: "use strict";var yre=Object.create;var qg=Object.defineProperty;var _re=Object.getOwnPropertyDescriptor;var bre=Object.getOwnPropertyNames;var vre=Object.getPrototypeOf,wre=Object.... L3: L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/ L5: `);super(n);h(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},zO=class extends Fo{get is_bubble_up(){return!0}},Mce=class extends Fo{constructor(t,e){super(t,e),this.na... L6: L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/ L8: `,t}var e_=spe.ns.sub("error"),rT=class extends e_.brand(Err

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.native.jsView on unpkg · L1

1if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol... L2: "use strict";var yre=Object.create;var qg=Object.defineProperty;var _re=Object.getOwnPropertyDescriptor;var bre=Object.getOwnPropertyNames;var vre=Object.getPrototypeOf,wre=Object.... L3: L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/ L5: `);super(n);h(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},zO=class extends Fo{get is_bubble_up(){return!0}},Mce=class extends Fo{constructor(t,e){super(t,e),this.na... L6: L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/ L8: `,t}var e_=spe.ns.sub("error"),rT=class extends e_.brand(Err

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.native.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.native.jsView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = keyring-agent-core@0.2.58 matchedIdentity = npm:a2V5cmluZy1hZ2VudC1jb3Jl:0.2.58 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg