Summary
Togoder Security scanned the npm package agent-base@7.1.4 on Oct 6, 2026. An AI review of 2 source files produced 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 2
Top-level code implements network capability at import time
NPS-CE390CA0D1D9
The module imports 'http' and 'https' at module load and defines a general-purpose request function. No requests are made at import time, but the capability is defined at the top level of the module.
Generic HTTP request helper enabled in package
NPS-C1F2FF5C6472
The exported req() function performs arbitrary HTTP/HTTPS requests to any URL. It only accepts a URL and options; it does not restrict hosts, protocols, or redirects implicitly. While this is a common utility pattern and not inherently malicious, exported network capability can be abused by downstream code or revisited if package maintainers push an update. The SDK itself does not exfiltrate data.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/helpers.js | medium | This file is a standard TypeScript-compiled helper utility (toBuffer, json, req) with no malicious patterns, though the exported req() function provides generic network request capability. |
| dist/index.js | safe | No malicious patterns detected; the code is a legitimate HTTP/HTTPS agent implementation with no exfiltration, obfuscation, or other suspicious behavior. |
Affected version ranges
None of the 2 scanned versions of agent-base are flagged high or critical. The latest scanned version, 7.1.4, is medium risk. Only versions we have scanned are listed; unscanned versions between them are not covered.
| Versions | Verdict | Count | Range | Top findings |
|---|---|---|---|---|
| 7.1.4 | Needs review | 1 | 7.1.4 | |
| 7.1.3 | Not scanned | 1 | 7.1.3 | |
| 6.0.2 | No issues | 1 | 6.0.2 |
Full list, including published versions not scanned yet: version ranges API.
Scanned versions of agent-base
Frequently asked questions
Is agent-base safe to use?
No confirmed malware was found in agent-base@7.1.4, but the review flagged 2 low severity findings for risky patterns worth checking before you rely on it.
Does agent-base contain malware?
No malware was identified in agent-base@7.1.4 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was agent-base checked?
Togoder Security downloaded the published npm package and had an AI model read its 2 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan agent-base together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in agent-base@7.1.4, cost nothing.