registry / keyring-agent-core / 0.3.20

keyring-agent-core@0.3.20

Core AI chat agent with multi-agent architecture, ReAct pattern, and modular tool system powered by Gemini

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The flagged wallet and metadata indicators are consistent with the package’s wallet-agent functionality and URL safety checks. The manifest has no install-time attack hook, and inspected wallet actions require a user request and frontend confirmation.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user requests a wallet action through the agent.

Impact

The inspected flow does not establish automatic or unconsented fund transfers.

Mechanism

The agent prepares a matching form or confirmation panel; the frontend submits the transaction after confirmation.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with high false-positive risk.

Evidence for AI clean decision

package.json lists a prepublishOnly build command; the inspected manifest has no preinstall, install, or postinstall hook.
dist/index.js exports wallet agent functionality as a library API.
The declared native-send tool forwards transaction intent to the frontend, which builds and submits the transaction.
The native agent sends wallet actions through a matching form, and the frontend submits the transaction after user confirmation.
The native bundle classifies cloud metadata hosts and rejects URLs pointing to metadata endpoints.

Evidence against

Behavioral surface

Source

CryptoEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 5.15 MB of source, external domains: 1rpc.io, abitype.dev, apac.smith.langchain.com, api.coingecko.com, api.coinpool.app, api.maple.finance, api.morpho.org, api.perpetuals.polymarket.com, api.relay.link, api.smith.langchain.com, api.v3.aave.com, app.aave.com, app.compound.finance, app.maple.finance, app.morpho.org, app.spark.finance, app.uniswap.org, arb1.arbitrum.io, arbiscan.io, arbitrum-one-rpc.publicnode.com, arbitrum.drpc.org, avalanche-c-chain-rpc.publicnode.com, avalanche.drpc.org, aws.smith.langchain.com, base-rpc.publicnode.com, base.drpc.org, basescan.org, beta.smith.langchain.com, bridge.polymarket.com, bsc-dataseed.binance.org, bsc-rpc.publicnode.com, bsc.drpc.org, bscscan.com, clob-preprod-int-v2.polymarket.com, clob.polymarket.com, coinpool.app, combos-rfq-api.polymarket.com, combos-rfq-collateral-return.polymarket.com, combos-rfq-gateway-builder.polymarket.com, data-api-preprod-int.polymarket.com, data-api.polymarket.com, dev.smith.langchain.com, dln.debridge.finance, docs.langchain.com, docs.soliditylang.org, empty.invalid, entry-gateway.backend-prod.api.uniswap.org, eth.drpc.org, ethereum-rpc.publicnode.com, etherscan.io

Source & flagged code

7 flagged

dist/index.native.jsView file

1if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol... L2: "use strict";var bwt=Object.create;var xC=Object.defineProperty;var vwt=Object.getOwnPropertyDescriptor;var _wt=Object.getOwnPropertyNames;var wwt=Object.getPrototypeOf,Swt=Object.... L3: `);super(o),Object.defineProperty(this,"details",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,"docsPath",{enumerable:!0,configurable:!0,writ... ... L65: L66: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let a of e.seen.entries()){let s=a[1];if(t===a[0]){o(a);continue}if(e.external){let l=e.exter... L67: `)}function tLt(e,t){let r=CFe(e

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index.native.jsView on unpkg · L1

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.native.jsView on unpkg · L1

813L814: USER QUERY: ${t}`,timestamp:0}];try{let s=(await this.llm.chat(n)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let c=JSON.parse(s[0]),l=[];for(let u of c)u.index>=0&&u.index<th... L815:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.native.jsView on unpkg · L813

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.native.jsView on unpkg · L1

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.native.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.native.jsView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = keyring-agent-core@0.3.19 matchedIdentity = npm:a2V5cmluZy1hZ2VudC1jb3Jl:0.3.19 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/index.native.jsView file

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index.native.jsView on unpkg · L1

Findings

3 Critical4 High3 Medium6 Low

CriticalWallet Draindist/index.native.js

CriticalRemote Asset Decode Executedist/index.native.js

CriticalPrevious Version Dangerous Deltadist/index.js

HighSame File Env Network Executiondist/index.native.js

HighCloud Metadata Accessdist/index.native.js

HighObfuscated Payload Loaderdist/index.native.js

HighSemantic Analysis Limiteddist/index.native.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

Affected versions and remediation

This report applies to keyring-agent-core@0.3.20.

See all versions of keyring-agent-core for other recorded verdicts.

Review the evidence and your use of keyring-agent-core@0.3.20 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 03:41:41.112Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.