registry / keyring-agent-core / 0.3.22

keyring-agent-core@0.3.22

Core AI chat agent with multi-agent architecture, ReAct pattern, and modular tool system powered by Gemini

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The scanner signals are consistent with wallet-signing functionality and bundled support code. Inspected runtime paths show user-facing forms for transfers and configuration-gated vector retrieval, with no confirmed malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Wallet tools require an action request; vector retrieval requires vectorKB.enabled.

Impact

No unconsented transfer, credential theft, or hidden execution was established.

Mechanism

Transfers stage forms that request a recipient and amount. Vector queries use the knowledge base only when the caller enables that feature.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with high false-positive risk.

Evidence for AI clean decision

package.json points to the inspected JavaScript bundles; its prepublishOnly hook runs a build.
Vector search is created only when vectorKB.enabled is true. It uses the configured provider or the bundled Upstash backend; the type declaration describes enabled as the master switch.
Wallet action tools expose user-facing forms. The native send form requests a recipient address and amount.

Evidence against

Behavioral surface

Source

CryptoEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 5.15 MB of source, external domains: 1rpc.io, abitype.dev, apac.smith.langchain.com, api.coingecko.com, api.coinpool.app, api.maple.finance, api.morpho.org, api.perpetuals.polymarket.com, api.relay.link, api.smith.langchain.com, api.v3.aave.com, app.aave.com, app.compound.finance, app.maple.finance, app.morpho.org, app.spark.finance, app.uniswap.org, arb1.arbitrum.io, arbiscan.io, arbitrum-one-rpc.publicnode.com, arbitrum.drpc.org, avalanche-c-chain-rpc.publicnode.com, avalanche.drpc.org, aws.smith.langchain.com, base-rpc.publicnode.com, base.drpc.org, basescan.org, beta.smith.langchain.com, bridge.polymarket.com, bsc-dataseed.binance.org, bsc-rpc.publicnode.com, bsc.drpc.org, bscscan.com, clob-preprod-int-v2.polymarket.com, clob.polymarket.com, coinpool.app, combos-rfq-api.polymarket.com, combos-rfq-collateral-return.polymarket.com, combos-rfq-gateway-builder.polymarket.com, data-api-preprod-int.polymarket.com, data-api.polymarket.com, dev.smith.langchain.com, dln.debridge.finance, docs.langchain.com, docs.soliditylang.org, empty.invalid, entry-gateway.backend-prod.api.uniswap.org, eth.drpc.org, ethereum-rpc.publicnode.com, etherscan.io

Source & flagged code

6 flagged

dist/index.native.jsView file

1if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol... L2: "use strict";var xwt=Object.create;var AC=Object.defineProperty;var Twt=Object.getOwnPropertyDescriptor;var Awt=Object.getOwnPropertyNames;var Pwt=Object.getPrototypeOf,Iwt=Object.... L3: `);super(o),Object.defineProperty(this,"details",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,"docsPath",{enumerable:!0,configurable:!0,writ... ... L65: L66: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let a of e.seen.entries()){let s=a[1];if(t===a[0]){o(a);continue}if(e.external){let l=e.exter... L67: `)}function cLt(e,t){let r=LFe(e

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index.native.jsView on unpkg · L1

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.native.jsView on unpkg · L1

813L814: USER QUERY: ${t}`,timestamp:0}];try{let s=(await this.llm.chat(n)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let c=JSON.parse(s[0]),l=[];for(let u of c)u.index>=0&&u.index<th... L815:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.native.jsView on unpkg · L813

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.native.jsView on unpkg · L1

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.native.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.native.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/index.native.jsView file

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index.native.jsView on unpkg · L1

Findings

2 Critical4 High3 Medium6 Low

CriticalWallet Draindist/index.native.js

CriticalRemote Asset Decode Executedist/index.native.js

HighSame File Env Network Executiondist/index.native.js

HighCloud Metadata Accessdist/index.native.js

HighObfuscated Payload Loaderdist/index.native.js

HighSemantic Analysis Limiteddist/index.native.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

Low

Affected versions and remediation

This report applies to keyring-agent-core@0.3.22.

See all versions of keyring-agent-core for other recorded verdicts.

Review the evidence and your use of keyring-agent-core@0.3.22 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 08:22:07.321Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.