keyring-agent-core@0.3.5
Core AI chat agent with multi-agent architecture, ReAct pattern, and modular tool system powered by Gemini
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe bundles contain an undisclosed remote data path with embedded service credentials, but it is activated only by explicit vectorKB configuration and does not establish malware behavior. Static hints about cloud metadata and execution are explained by bundled dependency code or safety checks.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A consumer enables vectorKB; uploads occur during chat when autoIngest is also enabled.
Impact
User prompts and configured knowledge-base content may be disclosed to a third-party endpoint without clear documentation.
Mechanism
Remote vector search and knowledge-base upload using embedded fallback credentials.
AI rationale
The bundles contain an undisclosed remote data path with embedded service credentials, but it is activated only by explicit vectorKB configuration and does not establish malware behavior. Static hints about cloud metadata and execution are explained by bundled dependency code or safety checks.
Evidence
dist/index.jsdist/index.native.js
Network endpoints1
perfect-octopus-59684-us1-vector.upstash.io
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The published runtime entry point is dist/index.js.
- Both runtime bundles embed an Upstash endpoint and a bearer-style token as fallbacks for the vector knowledge base.
- When vector storage is enabled, searches send prompts remotely; automatic ingestion can upload knowledge-base questions, answers, and metadata during chat.
- The README does not disclose the vector-store fallback or automatic remote knowledge-base ingestion.
Evidence against
- There is no install or postinstall hook; prepublishOnly only builds before publishing.
- The remote vector feature requires vectorKB.enabled, and automatic uploads additionally require autoIngest.
- The cloud-metadata strings are part of a URL-safety helper that rejects metadata endpoints, not an access attempt.
- No concrete shell execution, persistence, destructive action, or credential harvesting was found in the package-owned agent code.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
Source & flagged code
6 flagged · loading sourcedist/index.native.jsView file
681L682: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th...
L683:
High
Child Process
Package source references child process execution.
dist/index.native.jsView on unpkg · L681681L682: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th...
L683:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.native.jsView on unpkg · L6811if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol...
L2: "use strict";var jre=Object.create;var Vg=Object.defineProperty;var Fre=Object.getOwnPropertyDescriptor;var Bre=Object.getOwnPropertyNames;var zre=Object.getPrototypeOf,Vre=Object....
L3:
L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/
L5: `);super(n);f(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},uR=class extends Bo{get is_bubble_up(){return!0}},bue=class extends Bo{constructor(t,e){super(t,e),this.na...
L6:
L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/
L8: `,t}var f_=Hpe.ns.sub("error"),PT=class extends f_.brand(Err
Findings
1 Critical5 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.native.js
HighSame File Env Network Executiondist/index.native.js
HighCloud Metadata Accessdist/index.native.js
HighObfuscated Payload Loaderdist/index.native.js
HighSemantic Analysis Limiteddist/index.native.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to keyring-agent-core@0.3.5.
See all versions of keyring-agent-core for other recorded verdicts.
- Review the evidence and your use of keyring-agent-core@0.3.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.