Loading npm security reports…

keyring-agent-core@0.2.63: Malicious npm security report (Block) | LPM Firewall

registry / keyring-agent-core / 0.2.63

keyring-agent-core@0.2.63

Core AI chat agent with multi-agent architecture, ReAct pattern, and modular tool system powered by Gemini

AI Security Review

scanned 2h ago · by lpm-firewall-ai

At runtime, enabled vector-KB mode defaults to a package-owned remote Upstash index and credential. KB entries are uploaded there, including through optional auto-ingestion during chat execution.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Consumer enables vectorKB; autoIngest additionally runs on chat execution.

Impact

Configured knowledge-base content can be exfiltrated to an undeclared third-party endpoint; the package also exposes its remote-store credential.

Mechanism

Hard-coded authenticated vector-store fallback uploads configured KB data.

Attack narrative

A consumer enabling the advertised vector-KB feature without supplying both endpoint and token is silently routed to a hard-coded Upstash Vector service using a bundled credential. The implementation uploads question, answer, and metadata fields, and optional auto-ingest performs this upload while handling chat activity. This is a concrete remote data-transfer path rather than an inert dependency artifact.

Rationale

The main runtime bundle contains a hard-coded authenticated external data store that receives configured KB content. Although it is not install-time behavior and requires vector-KB enablement, the undisclosed credentialed fallback creates a concrete exfiltration path.

Evidence

package.jsondist/index.jsdist/index.native.js

Network endpoints1

perfect-octopus-59684-us1-vector.upstash.io

Decision evidence

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

Main bundle hard-codes an Upstash Vector endpoint and bundled fallback credential.
When vector KB is enabled without caller credentials, runtime selects those hard-coded defaults.
Knowledge-base question/answer metadata is upserted to that remote index.
autoIngest can send configured KB entries during chat execution.

Evidence against

No preinstall, install, or postinstall lifecycle hook; prepublishOnly is publish-time.
The metadata-address signals in the native bundle are SSRF denylist checks, not metadata requests.
Vector-KB activation requires explicit vectorKB.enabled configuration.

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 969 KB of source, external domains: 1rpc.io, api.coingecko.com, api.coinpool.app, api.relay.link, app.aave.com, app.compound.finance, app.morpho.org, app.spark.fi, app.uniswap.org, arb1.arbitrum.io, arbiscan.io, arbitrum-one-rpc.publicnode.com, arbitrum.drpc.org, avalanche-c-chain-rpc.publicnode.com, avalanche.drpc.org, base-rpc.publicnode.com, base.drpc.org, basescan.org, bsc-dataseed.binance.org, bsc-rpc.publicnode.com, bsc.drpc.org, bscscan.com, coinpool-api-op.bacoor-test001.xyz, coinpool.app, dln.debridge.finance, docs.langchain.com, eth.drpc.org, ethereum-rpc.publicnode.com, etherscan.io, exchange-api.keyring.app, explorer.mantle.xyz, gateway.thegraph.com, generativelanguage.googleapis.com, github.com, gnosis-rpc.publicnode.com, gnosis.drpc.org, gnosisscan.io, hyperevmscan.io, interface.gateway.uniswap.org, keyring.app, linea-rpc.publicnode.com, linea.drpc.org, lineascan.build, mainnet.base.org, mainnet.optimism.io, mantle-rpc.publicnode.com, mantlescan.xyz, monadscan.com, nft.keyring.app, optimism-rpc.publicnode.com

Oversized source lightweight scan

dist/index.native.js2.11 MB file, sampled 256 KB

ChildProcessEnvironmentVarsHighEntropyStringsUrlStringsdocs.langchain.comgithub.comrelay.linkwww.scamadviser.com

Source & flagged code

6 flagged · loading source

dist/index.native.jsView file

675L676: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th... L677:

High

Child Process

Package source references child process execution.

dist/index.native.jsView on unpkg · L675

675L676: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th... L677:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.native.jsView on unpkg · L675

1if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol... L2: "use strict";var Ere=Object.create;var jg=Object.defineProperty;var Cre=Object.getOwnPropertyDescriptor;var xre=Object.getOwnPropertyNames;var Ire=Object.getPrototypeOf,Ore=Object.... L3: L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/ L5: `);super(n);f(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},WO=class extends Bo{get is_bubble_up(){return!0}},zce=class extends Bo{constructor(t,e){super(t,e),this.na... L6: L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/ L8: `,t}var t_=mpe.ns.sub("error"),ak=class extends t_.brand(Err

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.native.jsView on unpkg · L1

1if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol... L2: "use strict";var Ere=Object.create;var jg=Object.defineProperty;var Cre=Object.getOwnPropertyDescriptor;var xre=Object.getOwnPropertyNames;var Ire=Object.getPrototypeOf,Ore=Object.... L3: L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/ L5: `);super(n);f(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},WO=class extends Bo{get is_bubble_up(){return!0}},zce=class extends Bo{constructor(t,e){super(t,e),this.na... L6: L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/ L8: `,t}var t_=mpe.ns.sub("error"),ak=class extends t_.brand(Err

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.native.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.native.jsView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = keyring-agent-core@0.2.60 matchedIdentity = npm:a2V5cmluZy1hZ2VudC1jb3Jl:0.2.60 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

6 flagged

dist/index.native.jsView file

675L676: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th... L677:

High

Child Process

Package source references child process execution.

dist/index.native.jsView on unpkg · L675

675L676: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th... L677:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.native.jsView on unpkg · L675

1if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol... L2: "use strict";var Ere=Object.create;var jg=Object.defineProperty;var Cre=Object.getOwnPropertyDescriptor;var xre=Object.getOwnPropertyNames;var Ire=Object.getPrototypeOf,Ore=Object.... L3: L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/ L5: `);super(n);f(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},WO=class extends Bo{get is_bubble_up(){return!0}},zce=class extends Bo{constructor(t,e){super(t,e),this.na... L6: L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/ L8: `,t}var t_=mpe.ns.sub("error"),ak=class extends t_.brand(Err

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.native.jsView on unpkg · L1

1if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol... L2: "use strict";var Ere=Object.create;var jg=Object.defineProperty;var Cre=Object.getOwnPropertyDescriptor;var xre=Object.getOwnPropertyNames;var Ire=Object.getPrototypeOf,Ore=Object.... L3: L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/ L5: `);super(n);f(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},WO=class extends Bo{get is_bubble_up(){return!0}},zce=class extends Bo{constructor(t,e){super(t,e),this.na... L6: L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/ L8: `,t}var t_=mpe.ns.sub("error"),ak=class extends t_.brand(Err

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.native.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.native.jsView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = keyring-agent-core@0.2.60 matchedIdentity = npm:a2V5cmluZy1hZ2VudC1jb3Jl:0.2.60 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg