keyring-agent-core@0.3.15
Core AI chat agent with multi-agent architecture, ReAct pattern, and modular tool system powered by Gemini
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe embedded fallback remote vector service and upload path create a concrete conditional data-exposure risk. The feature is caller-gated and no lifecycle hook was found, so blocking as malware is not supported.
Static reason
One or more suspicious static signals were detected.
Trigger
A caller enables the vector knowledge-base feature and ingests entries.
Impact
Caller-provided knowledge-base content may be exposed to the built-in remote service under a conditional configuration path.
Mechanism
The provider selects configured values or built-in defaults, then sends entry questions, answers, and metadata through the vector-index upsert operation.
AI rationale
The embedded fallback remote vector service and upload path create a concrete conditional data-exposure risk. The feature is caller-gated and no lifecycle hook was found, so blocking as malware is not supported.
Evidence
dist/index.native.js
Network endpoints1
perfect-octopus-59684-us1-vector.upstash.io
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package scripts show no registry install lifecycle hook.
- The native bundle embeds a default Upstash Vector service endpoint.
- Enabling the vector knowledge-base option constructs the provider from caller fields, which can fall back to built-in defaults.
- The provider uploads knowledge-base questions, answers, and metadata to the configured vector index.
Evidence against
- The vector knowledge-base path is gated by an enabled configuration option.
- No child-process use was found in the native entrypoint.
Behavioral surface
EnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
4 flagged · loading sourcedist/index.native.jsView file
681L682: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th...
L683:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.native.jsView on unpkg · L6811if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol...
L2: "use strict";var sie=Object.create;var wy=Object.defineProperty;var lie=Object.getOwnPropertyDescriptor;var cie=Object.getOwnPropertyNames;var uie=Object.getPrototypeOf,die=Object....
L3:
L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/
L5: `);super(n);f(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},dN=class extends Xo{get is_bubble_up(){return!0}},hpe=class extends Xo{constructor(t,e){super(t,e),this.na...
L6:
L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/
L8: `,t}var rb=qfe.ns.sub("error"),wk=class extends rb.brand(Err
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/index.native.jsView on unpkg · L1Findings
4 High3 Medium6 Low
HighSame File Env Network Executiondist/index.native.js
HighCloud Metadata Accessdist/index.native.js
HighObfuscated Payload Loaderdist/index.native.js
HighSemantic Analysis Limiteddist/index.native.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to keyring-agent-core@0.3.15.
See all versions of keyring-agent-core for other recorded verdicts.
- Review the evidence and your use of keyring-agent-core@0.3.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.