registry / keyring-agent-core / 0.3.12

keyring-agent-core@0.3.12

Core AI chat agent with multi-agent architecture, ReAct pattern, and modular tool system powered by Gemini

AI Security Review

scanned 29d ago · by lpm-firewall-ai

The published entrypoints are library bundles with no npm install lifecycle, and searches found no shell execution, eval, or secret harvesting. Default third-party API and vector endpoints are part of the stated agent and knowledge-base features and run only when the host application calls them.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A consumer imports the library and calls an agent, tool, or knowledge-base method.

Impact

No unconsented mutation, credential theft, or remote payload execution was established from the inspected entrypoints.

Mechanism

Runtime helpers issue HTTPS requests with caller-supplied or package-default API settings. Nothing in package.json runs on npm install.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 82.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json 0.3.12 exposes dist/index.js and dist/index.native.js and has no preinstall, install, or postinstall script; the only publish script is prepublishOnly running the build.
dist/index.js is a library bundle that sets a Keyring user-agent and exports agent, wallet, and DeFi helpers through module.exports, with network calls only when those helpers run.
dist/index.native.js is the React Native bundle and begins with stream and symbol polyfills, not an installer or loader.

Evidence against

A default Upstash Vector URL and REST token are embedded for the package knowledge-base client and can be overridden by the caller or environment; queries send the caller text to that configured index when search or upsert is invoked.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

5 flagged

dist/index.native.jsView file

681L682: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th... L683:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.native.jsView on unpkg · L681

1if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol... L2: "use strict";var Qne=Object.create;var gy=Object.defineProperty;var eie=Object.getOwnPropertyDescriptor;var tie=Object.getOwnPropertyNames;var rie=Object.getPrototypeOf,nie=Object.... L3: L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/ L5: `);super(n);f(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},iN=class extends Xo{get is_bubble_up(){return!0}},ope=class extends Xo{constructor(t,e){super(t,e),this.na... L6: L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/ L8: `,t}var W_=Ofe.ns.sub("error"),hk=class extends W_.brand(Err

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.native.jsView on unpkg · L1

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.native.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.native.jsView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = keyring-agent-core@0.3.9 matchedIdentity = npm:a2V5cmluZy1hZ2VudC1jb3Jl:0.3.9 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/index.native.jsView file

681L682: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th... L683:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.native.jsView on unpkg · L681

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.native.jsView on unpkg · L1

Findings

1 Critical4 High3 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighSame File Env Network Executiondist/index.native.js

HighCloud Metadata Accessdist/index.native.js

HighObfuscated Payload Loaderdist/index.native.js

HighSemantic Analysis Limiteddist/index.native.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to keyring-agent-core@0.3.12.

See all versions of keyring-agent-core for other recorded verdicts.

Review the evidence and your use of keyring-agent-core@0.3.12 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-24 02:32:41.231Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.