registry / Data exfiltration / keyring-agent-core / 0.2.62

keyring-agent-core@0.2.62

Core AI chat agent with multi-agent architecture, ReAct pattern, and modular tool system powered by Gemini

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The fixed fallback endpoint and remote query path create a real conditional data-disclosure risk. The explicit feature gate and absence of install hooks do not support blocking publication.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A consumer enables vectorKB and invokes a knowledge-base search.

Impact

Knowledge-base search text may be disclosed to the embedded endpoint under this conditional configuration.

Mechanism

The bundles select the embedded Upstash endpoint as a fallback and submit the search input through the vector client's query operation.

AI rationale

The fixed fallback endpoint and remote query path create a real conditional data-disclosure risk. The explicit feature gate and absence of install hooks do not support blocking publication.

Evidence

dist/index.jsdist/index.native.js

Network endpoints1

perfect-octopus-59684-us1-vector.upstash.io

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The main bundle embeds a fixed Upstash Vector endpoint and uses it when neither configuration nor environment supplies a URL.
When vectorKB is enabled, the package creates that vector client and sends each search input as query data to it.
The React Native bundle contains the same conditional vector-client setup and query sink.
The manifest has only a prepublish build hook, not an install-time hook.

Evidence against

Vector storage is conditional on the caller enabling vectorKB, and the caller can provide a URL and token.
No automatic install-time execution, shell execution, metadata retrieval, or local-file harvesting was found in the inspected entrypoints.

Behavioral surface

Source

EnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

7 flagged

dist/index.native.jsView file

675L676: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th... L677:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.native.jsView on unpkg · L675

1if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol... L2: "use strict";var Ere=Object.create;var jg=Object.defineProperty;var Cre=Object.getOwnPropertyDescriptor;var xre=Object.getOwnPropertyNames;var Ire=Object.getPrototypeOf,Ore=Object.... L3: L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/ L5: `);super(n);f(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},WO=class extends Bo{get is_bubble_up(){return!0}},zce=class extends Bo{constructor(t,e){super(t,e),this.na... L6: L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/ L8: `,t}var t_=mpe.ns.sub("error"),ak=class extends t_.brand(Err

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.native.jsView on unpkg · L1

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.native.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.native.jsView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = keyring-agent-core@0.3.9 matchedIdentity = npm:a2V5cmluZy1hZ2VudC1jb3Jl:0.3.9 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = keyring-agent-core@0.2.63 matchedPath = dist/index.js matchedIdentity = npm:a2V5cmluZy1hZ2VudC1jb3Jl:0.2.63 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 0b626b89c86c3b29 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = keyring-agent-core@0.2.63 matchedPath = dist/index.js matchedIdentity = npm:a2V5cmluZy1hZ2VudC1jb3Jl:0.2.63 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/index.native.jsView file

675L676: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th... L677:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.native.jsView on unpkg · L675

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.native.jsView on unpkg · L1

Findings

1 Critical6 High3 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighSame File Env Network Executiondist/index.native.js

HighCloud Metadata Accessdist/index.native.js

HighObfuscated Payload Loaderdist/index.native.js

HighSemantic Analysis Limiteddist/index.native.js

HighKnown Malware Source Similaritydist/index.js

HighKnown Malware Source Fingerprint Signaturedist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

Low

Affected versions and remediation

This report applies to keyring-agent-core@0.2.62.

See all versions of keyring-agent-core for other recorded verdicts.

Review the evidence and your use of keyring-agent-core@0.2.62 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-20 07:19:41.928Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.