# agent-base@7.1.4 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-06T14:13:33.000Z
- Files reviewed: 2
- Findings: 2 low severity findings
- Report: https://security.togoder.click/npm/agent-base@7.1.4
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package agent-base@7.1.4 on Oct 6, 2026. An AI review of 2 source files produced 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [low] Top-level code implements network capability at import time

Finding ID: `NPS-CE390CA0D1D9`

File: `dist/helpers.js:44`

The module imports 'http' and 'https' at module load and defines a general-purpose request function. No requests are made at import time, but the capability is defined at the top level of the module.

### [low] Generic HTTP request helper enabled in package

Finding ID: `NPS-C1F2FF5C6472`

File: `dist/helpers.js:58`

The exported req() function performs arbitrary HTTP/HTTPS requests to any URL. It only accepts a URL and options; it does not restrict hosts, protocols, or redirects implicitly. While this is a common utility pattern and not inherently malicious, exported network capability can be abused by downstream code or revisited if package maintainers push an update. The SDK itself does not exfiltrate data.

## Files reviewed

- `dist/helpers.js` (medium): This file is a standard TypeScript-compiled helper utility (toBuffer, json, req) with no malicious patterns, though the exported req() function provides generic network request capability.
- `dist/index.js` (safe): No malicious patterns detected; the code is a legitimate HTTP/HTTPS agent implementation with no exfiltration, obfuscation, or other suspicious behavior.

## Version ranges

None of the 2 scanned versions of agent-base are flagged high or critical. The latest scanned version, 7.1.4, is medium risk. Only versions we have scanned are listed; unscanned versions between them are not covered.

- 7.1.4 (`7.1.4`): medium
- 7.1.3 (`7.1.3`): not scanned
- 6.0.2 (`6.0.2`): clean

## Scanned versions

- [7.1.4](https://security.togoder.click/npm/agent-base@7.1.4): medium, 2026-10-06T14:13:33.000Z
- [6.0.2](https://security.togoder.click/npm/agent-base@6.0.2): safe, 2026-10-04T14:37:24.000Z

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology