keyring-agent-core@0.3.8
Core AI chat agent with multi-agent architecture, ReAct pattern, and modular tool system powered by Gemini
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is a real remote-upload capability with a hard-coded destination, but it is activated only through an explicit vectorKB and autoIngest configuration. There is no install-time execution or confirmed arbitrary payload execution.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A consumer creates AgentCore with vectorKB enabled and autoIngest true, then uses chat.
Impact
Knowledge-base content may be disclosed to a service chosen by the package rather than the consumer.
Mechanism
Automatic vector-store upload to a hard-coded remote service.
AI rationale
This is a real remote-upload capability with a hard-coded destination, but it is activated only through an explicit vectorKB and autoIngest configuration. There is no install-time execution or confirmed arbitrary payload execution.
Evidence
dist/index.jsdist/index.native.js
Network endpoints1
perfect-octopus-59684-us1-vector.upstash.io
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The native build hard-codes an Upstash Vector service endpoint instead of requiring a caller-supplied endpoint.
- When enabled, the vector knowledge-base feature uploads configured knowledge-base entries to that service, including through automatic ingestion.
- The Node build contains the same automatic-ingestion path, so the behavior is not limited to the native artifact.
Evidence against
- package.json has only a prepublish build hook; it has no install-time lifecycle hook.
- The upload path is gated by the caller enabling vectorKB and autoIngest.
- No shell execution, dynamic code evaluation, or filesystem harvesting was found in the inspected entry builds.
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flagged · loading sourcedist/index.native.jsView file
681L682: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th...
L683:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.native.jsView on unpkg · L6811if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol...
L2: "use strict";var Vne=Object.create;var hy=Object.defineProperty;var Hne=Object.getOwnPropertyDescriptor;var Zne=Object.getOwnPropertyNames;var Gne=Object.getPrototypeOf,Wne=Object....
L3:
L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/
L5: `);super(n);f(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},QR=class extends Yo{get is_bubble_up(){return!0}},Bde=class extends Yo{constructor(t,e){super(t,e),this.na...
L6:
L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/
L8: `,t}var H_=ffe.ns.sub("error"),ck=class extends H_.brand(Err
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/index.native.jsView on unpkg · L1Findings
1 Critical4 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighSame File Env Network Executiondist/index.native.js
HighCloud Metadata Accessdist/index.native.js
HighObfuscated Payload Loaderdist/index.native.js
HighSemantic Analysis Limiteddist/index.native.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to keyring-agent-core@0.3.8.
See all versions of keyring-agent-core for other recorded verdicts.
- Review the evidence and your use of keyring-agent-core@0.3.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.