registry / keyring-agent-core / 0.3.21
keyring-agent-core@0.3.21
Core AI chat agent with multi-agent architecture, ReAct pattern, and modular tool system powered by Gemini
AI Security Review
scanned 9d ago · by lpm-firewall-aiSource inspection found no concrete attack behavior. The scanner matches correspond to package functionality with user action or configuration gates, and its cloud-metadata matches are part of a private-network denylist.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
No malicious trigger was found; wallet actions require a user-requested form submission, and vector search requires explicit enablement.
Impact
No malicious impact was identified; the wallet action flow asks the user to review and submit its details.
Mechanism
The inspected source does not show decoded remote content being executed or an unrequested wallet transfer. Automatic knowledge-base ingestion has an additional opt-in setting.
AI rationale
Source inspection found no concrete attack behavior. The scanner matches correspond to package functionality with user action or configuration gates, and its cloud-metadata matches are part of a private-network denylist.
Evidence
package.jsondist/index.jsdist/index.d.tsdist/index.native.js
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- package.json has no install hook; its prepublishOnly script runs the build.
- The native-send tool collects a recipient and amount, then asks the user to review and submit the form.
- Vector search is selected only when enabled; its types document Upstash as the backend and disabled behavior as the legacy matcher.
- Automatic knowledge-base ingestion requires autoIngest to be explicitly true.
- The data-URI path parses JSON to extract an image URL; it does not execute the decoded content.
- The eval-enabled worker runs bundled serialization code, and the metadata addresses appear in a private-network denylist.
Evidence against
Behavioral surface
CryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flagged · loading sourcedist/index.native.jsView file
1if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol...
L2: "use strict";var wwt=Object.create;var TC=Object.defineProperty;var Swt=Object.getOwnPropertyDescriptor;var kwt=Object.getOwnPropertyNames;var xwt=Object.getPrototypeOf,Twt=Object....
L3: `);super(o),Object.defineProperty(this,"details",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,"docsPath",{enumerable:!0,configurable:!0,writ...
...
L65:
L66: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let a of e.seen.entries()){let s=a[1];if(t===a[0]){o(a);continue}if(e.external){let l=e.exter...
L67: `)}function iLt(e,t){let r=NFe(e
Critical
Wallet Drain
Source uses private key material to transfer cryptocurrency funds.
dist/index.native.jsView on unpkg · L11if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol...
L2: "use strict";var wwt=Object.create;var TC=Object.defineProperty;var Swt=Object.getOwnPropertyDescriptor;var kwt=Object.getOwnPropertyNames;var xwt=Object.getPrototypeOf,Twt=Object....
L3: `);super(o),Object.defineProperty(this,"details",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,"docsPath",{enumerable:!0,configurable:!0,writ...
...
L65:
L66: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let a of e.seen.entries()){let s=a[1];if(t===a[0]){o(a);continue}if(e.external){let l=e.exter...
L67: `)}function iLt(e,t){let r=NFe(e
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/index.native.jsView on unpkg · L1813L814: USER QUERY: ${t}`,timestamp:0}];try{let s=(await this.llm.chat(n)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let c=JSON.parse(s[0]),l=[];for(let u of c)u.index>=0&&u.index<th...
L815:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.native.jsView on unpkg · L8131if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol...
L2: "use strict";var wwt=Object.create;var TC=Object.defineProperty;var Swt=Object.getOwnPropertyDescriptor;var kwt=Object.getOwnPropertyNames;var xwt=Object.getPrototypeOf,Twt=Object....
L3: `);super(o),Object.defineProperty(this,"details",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,"docsPath",{enumerable:!0,configurable:!0,writ...
...
L65:
L66: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let a of e.seen.entries()){let s=a[1];if(t===a[0]){o(a);continue}if(e.external){let l=e.exter...
L67: `)}function iLt(e,t){let r=NFe(e
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/index.native.jsView on unpkg · L11if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol...
L2: "use strict";var wwt=Object.create;var TC=Object.defineProperty;var Swt=Object.getOwnPropertyDescriptor;var kwt=Object.getOwnPropertyNames;var xwt=Object.getPrototypeOf,Twt=Object....
L3: `);super(o),Object.defineProperty(this,"details",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,"docsPath",{enumerable:!0,configurable:!0,writ...
...
L65:
L66: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let a of e.seen.entries()){let s=a[1];if(t===a[0]){o(a);continue}if(e.external){let l=e.exter...
L67: `)}function iLt(e,t){let r=NFe(e
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/index.native.jsView on unpkg · L1•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.native.jsView on unpkgFindings
2 Critical4 High3 Medium6 Low
CriticalWallet Draindist/index.native.js
CriticalRemote Asset Decode Executedist/index.native.js
HighSame File Env Network Executiondist/index.native.js
HighCloud Metadata Accessdist/index.native.js
HighObfuscated Payload Loaderdist/index.native.js
HighSemantic Analysis Limiteddist/index.native.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to keyring-agent-core@0.3.21.
See all versions of keyring-agent-core for other recorded verdicts.
- Review the evidence and your use of keyring-agent-core@0.3.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.