keyring-agent-core@0.3.9
Core AI chat agent with multi-agent architecture, ReAct pattern, and modular tool system powered by Gemini
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe undisclosed credentialed backend creates a concrete runtime data-disclosure risk, but it is gated behind consumer-enabled knowledge-base operations and no install-time execution was found.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer enables vectorKB and autoIngest, calls ingestKnowledgeBase, or constructs the exported Upstash knowledge-base client without credentials.
Impact
Caller knowledge-base content may be disclosed to a package-controlled remote service.
Mechanism
Hidden remote vector-store credential fallback and knowledge-base upload.
AI rationale
The undisclosed credentialed backend creates a concrete runtime data-disclosure risk, but it is gated behind consumer-enabled knowledge-base operations and no install-time execution was found.
Evidence
dist/index.jsdist/index.native.js
Network endpoints1
perfect-octopus-59684-us1-vector.upstash.io
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The runtime bundle hard-codes an Upstash endpoint and uses it when vector credentials are absent.
- The vector client silently falls back to a bundled token, then can upload caller-provided knowledge-base entries.
- The public types say credentials fall back to environment variables, which does not disclose the bundled service fallback.
Evidence against
- package.json has only a prepublish build hook, so registry installation does not run package code.
- Knowledge-base upload requires vector mode and either auto-ingest or an explicit ingestion call.
- No package-owned child-process or cloud-metadata access was confirmed; the metadata strings are SSRF-blocking rules in bundled dependencies.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flagged · loading sourcedist/index.native.jsView file
681L682: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th...
L683:
High
Child Process
Package source references child process execution.
dist/index.native.jsView on unpkg · L681681L682: USER QUERY: ${e}`,timestamp:0}];try{let s=(await this.llm.chat(i)).text.trim().match(/\[[\s\S]*\]/);if(!s)return[];let l=JSON.parse(s[0]),c=[];for(let u of l)u.index>=0&&u.index<th...
L683:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.native.jsView on unpkg · L6811if(typeof Symbol!=="undefined"){if(!Symbol.asyncIterator){try{Symbol.asyncIterator=Symbol("Symbol.asyncIterator")}catch(e){}}if(!Symbol.asyncDispose){try{Symbol.asyncDispose=Symbol...
L2: "use strict";var Vne=Object.create;var my=Object.defineProperty;var Hne=Object.getOwnPropertyDescriptor;var Zne=Object.getOwnPropertyNames;var Gne=Object.getPrototypeOf,Wne=Object....
L3:
L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${r.lc_error_code}/
L5: `);super(n);f(this,"lc_error_code");this.lc_error_code=r?.lc_error_code}},tN=class extends Xo{get is_bubble_up(){return!0}},Bde=class extends Xo{constructor(t,e){super(t,e),this.na...
L6:
L7: Troubleshooting URL: https://docs.langchain.[redacted]/${e}/
L8: `,t}var G_=ffe.ns.sub("error"),dk=class extends G_.brand(Err
Findings
5 High3 Medium4 Low
HighChild Processdist/index.native.js
HighSame File Env Network Executiondist/index.native.js
HighCloud Metadata Accessdist/index.native.js
HighObfuscated Payload Loaderdist/index.native.js
HighSemantic Analysis Limiteddist/index.native.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to keyring-agent-core@0.3.9.
See all versions of keyring-agent-core for other recorded verdicts.
- Review the evidence and your use of keyring-agent-core@0.3.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.