keyring-agent-core@0.3.19: Clean npm security report (Allow)

AI Security Review

scanned 23d ago · by lpm-firewall-ai

Inspected entrypoints support the package's AI and wallet functionality without a concrete malicious execution chain. Caller-supplied authentication and stubbed native filesystem helpers do not establish credential harvesting or install-time mutation.

Static reason

One or more suspicious static signals were detected.

Trigger

Caller invocation of exported agent and tool methods; no automatic install attack was identified.

Impact

Normal application network access and interface generation; no confirmed credential theft, remote code execution, or agent control-surface mutation.

Mechanism

Configured clients send application inputs to AI and data services, while wallet tools produce interface parameters.

AI rationale

Inspected entrypoints support the package's AI and wallet functionality without a concrete malicious execution chain. Caller-supplied authentication and stubbed native filesystem helpers do not establish credential harvesting or install-time mutation.

Network endpoints3

generativelanguage.googleapis.comnft.keyring.app/api/gemini-stableperfect-octopus-59684-us1-vector.upstash.io

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json has no registry install lifecycle hooks or runtime self-dependency.
The native Gemini provider takes its API key and optional endpoint from caller configuration.
Gemini requests send caller-supplied credentials with chat content through the configured client.
Wallet action tools construct interface components from action parameters.
Bundled native filesystem adapters reference empty module stubs rather than working filesystem imports.

Evidence against

Behavioral surface

Source

EnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.95 MB of source, external domains: 1rpc.io, apac.smith.langchain.com, api.coingecko.com, api.coinpool.app, api.maple.finance, api.morpho.org, api.relay.link, api.smith.langchain.com, api.v3.aave.com, app.aave.com, app.compound.finance, app.maple.finance, app.morpho.org, app.spark.finance, app.uniswap.org, arb1.arbitrum.io, arbiscan.io, arbitrum-one-rpc.publicnode.com, arbitrum.drpc.org, avalanche-c-chain-rpc.publicnode.com, avalanche.drpc.org, aws.smith.langchain.com, base-rpc.publicnode.com, base.drpc.org, basescan.org, beta.smith.langchain.com, bsc-dataseed.binance.org, bsc-rpc.publicnode.com, bsc.drpc.org, bscscan.com, coinpool.app, dev.smith.langchain.com, dln.debridge.finance, docs.langchain.com, entry-gateway.backend-prod.api.uniswap.org, eth.drpc.org, ethereum-rpc.publicnode.com, etherscan.io, eu.smith.langchain.com, exchange-api.keyring.app, explorer.mantle.xyz, gateway.thegraph.com, generativelanguage.googleapis.com, github.com, gnosis-rpc.publicnode.com, gnosis.drpc.org, gnosisscan.io, hyperevmscan.io, interface.gateway.uniswap.org, ipfs.pantograph.app

Source & flagged code

4 flagged

dist/index.native.jsView file

684L685: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th... L686:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.native.jsView on unpkg · L684

1if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol... L2: "use strict";var uie=Object.create;var wy=Object.defineProperty;var die=Object.getOwnPropertyDescriptor;var pie=Object.getOwnPropertyNames;var hie=Object.getPrototypeOf,fie=Object.... L3: L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/ L5: `);super(n);f(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},pN=class extends Qo{get is_bubble_up(){return!0}},_pe=class extends Qo{constructor(t,e){super(t,e),this.na... L6: L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/ L8: `,t}var rb=Vfe.ns.sub("error"),Sk=class extends rb.brand(Err

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.native.jsView on unpkg · L1

1if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol... L2: "use strict";var uie=Object.create;var wy=Object.defineProperty;var die=Object.getOwnPropertyDescriptor;var pie=Object.getOwnPropertyNames;var hie=Object.getPrototypeOf,fie=Object.... L3: L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/ L5: `);super(n);f(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},pN=class extends Qo{get is_bubble_up(){return!0}},_pe=class extends Qo{constructor(t,e){super(t,e),this.na... L6: L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/ L8: `,t}var rb=Vfe.ns.sub("error"),Sk=class extends rb.brand(Err

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.native.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.native.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/index.native.jsView file

684L685: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th... L686:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.native.jsView on unpkg · L684

1if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol... L2: "use strict";var uie=Object.create;var wy=Object.defineProperty;var die=Object.getOwnPropertyDescriptor;var pie=Object.getOwnPropertyNames;var hie=Object.getPrototypeOf,fie=Object.... L3: L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/ L5: `);super(n);f(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},pN=class extends Qo{get is_bubble_up(){return!0}},_pe=class extends Qo{constructor(t,e){super(t,e),this.na... L6: L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/ L8: `,t}var rb=Vfe.ns.sub("error"),Sk=class extends rb.brand(Err

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.native.jsView on unpkg · L1

Findings

4 High3 Medium6 Low

HighSame File Env Network Executiondist/index.native.js

HighCloud Metadata Accessdist/index.native.js

HighObfuscated Payload Loaderdist/index.native.js

HighSemantic Analysis Limiteddist/index.native.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code