Loading npm security reports…

@yeaft/webchat-agent@1.0.172: Malicious npm security report | LPM Firewall

registry / @yeaft/webchat-agent / 1.0.172

@yeaft/webchat-agent@1.0.172

Remote worker agent for Yeaft Web Code Agent — connects the native Yeaft engine, CLI providers, and workbench tools

OSV Malicious Advisory

scanned 9d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-10723 confirms this npm version as malicious. The package installs itself as a user-level service (systemd on Linux via service/linux.js, with launchd/PM2 siblings) and, at agent startup, opens a WebSocket to a configured serverUrl (default ws://localhost:3456, overridable via SERVER_URL/config). The WebSocket message router in connection/message-router.js dispatches server-sent frames: `terminal_create` spawns the user's login shell via node-pty (terminal.js:...

Advisory

MAL-2026-10723

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @yeaft/webchat-agent (npm)

Details

The package installs itself as a user-level service (systemd on Linux via service/linux.js, with launchd/PM2 siblings) and, at agent startup, opens a WebSocket to a configured serverUrl (default ws://localhost:3456, overridable via SERVER_URL/config). The WebSocket message router in connection/message-router.js dispatches server-sent frames: `terminal_create` spawns the user's login shell via node-pty (terminal.js: `pty.spawn(shell,...)`) in the agent's workDir, and `terminal_input` writes the server's `msg.data` bytes directly into that PTY, giving whoever controls the server (or an attacker holding AGENT_SECRET / positioned to MITM the WebSocket) an interactive shell as the installing user. An `upgrade_agent` message handled by connection/upgrade.js runs `npm install @yeaft/webchat-agent@latest --registry=https://pkg.yeaft.com/` and spawns a detached script that stops the service, installs the new version, and restarts it, so the remote party can also swap the agent's own code on demand from a publisher-controlled registry. On every startup, index.js additionally git-clones https://github.com/yeaft/yeaft-skills.git from the mutable `main` branch into ~/.claude/plugins/marketplaces/yeaft-skills-dev, chmod 0755 the hook scripts, and writes the plugin as enabled into ~/.claude/settings.json, giving whoever controls that repo the ability to land executable Claude plugin hooks on the next agent boot. The service/linux.js unit also prepends ~/.local/bin and ~/.npm-global/bin to PATH in the service environment. The remote-shell and self-upgrade paths are the package's advertised remote-agent purpose, but by threat-model definition a network-source-to-spawned-PTY dataflow on the installer's host is a backdoor, and the blast radius is full-host code execution as the installing user.

Source & flagged code

7 flagged · loading source

connection/upgrade.jsView file

1import { execFile, execFileSync, spawn } from 'child_process'; L2: import { writeFileSync, mkdirSync, existsSync, cpSync } from 'fs';

High

Child Process

Package source references child process execution.

connection/upgrade.jsView on unpkg · L1

28const isWin = platform() === 'win32'; L29: // Windows: use bare 'npm'/'pm2' + shell:true — cmd.exe finds them via PATH. L30: // This was the working pattern before ce58bbc. Absolute paths break when

High

Shell

Package source references shell execution.

connection/upgrade.jsView on unpkg · L28

1import { execFile, execFileSync, spawn } from 'child_process'; L2: import { writeFileSync, mkdirSync, existsSync, cpSync } from 'fs'; ... L20: export function resolveInstanceId() { L21: return ctx.CONFIG?.instanceId || process.env.YEAFT_AGENT_INSTANCE || DEFAULT_INSTANCE_ID; L22: } ... L28: const isWin = platform() === 'win32'; L29: // Windows: use bare 'npm'/'pm2' + shell:true — cmd.exe finds them via PATH. L30: // This was the working pattern before ce58bbc. Absolute paths break when ... L41: const safeEnv = { ...process.env, PATH: safePath }; L42: export const PUBLIC_NPM_REGISTRY = 'https://registry.npmjs.org/'; L43: ... L74: // Shared cleanup logic for restart/upgrade

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

connection/upgrade.jsView on unpkg · L1

connection/upgrade-worker-template.jsView file

1'use strict'; L2: const fs = require('fs'); L3: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

connection/upgrade-worker-template.jsView on unpkg · L1

yeaft/tools/js-repl.jsView file

1/** L2: * js-repl.js — JavaScript REPL for evaluating expressions.

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

yeaft/tools/js-repl.jsView on unpkg · L1

service/windows.jsView file

19console.log('Installing pm2...'); L20: execSync('npm install -g pm2', { stdio: 'inherit' }); L21: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

service/windows.jsView on unpkg · L19

cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @yeaft/webchat-agent@1.0.118 matchedIdentity = npm:QHllYWZ0L3dlYmNoYXQtYWdlbnQ:1.0.118 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli.jsView on unpkg

Source & flagged code

7 flagged

connection/upgrade.jsView file

Lines 1-48javascript

1import { execFile, execFileSync, spawn } from 'child_process';

2import { writeFileSync, mkdirSync, existsSync, cpSync } from 'fs';

High

Child Process

Package source references child process execution.

connection/upgrade.jsView on unpkg · L1

3import { join, dirname } from 'path';

4import { fileURLToPath } from 'url';

5import { platform, homedir } from 'os';

6import ctx from '../context.js';

7import { getConfigDir, getServiceName, getPm2AppName, getLaunchdPlistPath, DEFAULT_INSTANCE_ID } from '../service.js';

8import { sendToServer } from './buffer.js';

9import { stopAgentHeartbeat } from './heartbeat.js';

10

11/**

12 * Resolve the local service instance id for this running agent. Each agent

13 * process is pinned to one instance (set in index.js from

14 * YEAFT_AGENT_INSTANCE / config), so the upgrade flow must target THAT

15 * instance's service unit — not the bare `yeaft-agent` default. Without this,

16 * a named instance (e.g. `server-e7a9eb`) installs the new package but its

17 * systemd unit `yeaft-agent@server-e7a9eb` is never restarted, leaving the

18 * agent permanently offline after a UI-triggered upgrade.

19 */

20export function resolveInstanceId() {

21 return ctx.CONFIG?.instanceId || process.env.YEAFT_AGENT_INSTANCE || DEFAULT_INSTANCE_ID;

22}

23

24// Derive absolute paths for npm/pm2 from current node executable.

25// In launchd/systemd environments, PATH may not include nvm/node dirs,

26// but process.execPath always points to the running node binary.

27const nodeBinDir = dirname(process.execPath);

28const isWin = platform() === 'win32';

29// Windows: use bare 'npm'/'pm2' + shell:true — cmd.exe finds them via PATH.

30// This was the working pattern before ce58bbc. Absolute paths break when

High

Shell

Package source references shell execution.

connection/upgrade.jsView on unpkg · L28

31// the path contains spaces (e.g., "C:\Program Files\nodejs\npm.cmd").

32// macOS/Linux: use absolute path — launchd/systemd have minimal PATH.

33const npmPath = isWin ? 'npm' : join(nodeBinDir, 'npm');

34const pm2Path = isWin ? 'pm2' : join(nodeBinDir, 'pm2');

35const shellOpt = isWin ? { shell: true, windowsHide: true } : {};

36

37// Ensure PATH includes nodeBinDir so that `#!/usr/bin/env node` shebangs

38// can locate node in launchd/systemd environments with minimal PATH.

39const currentPath = process.env.PATH || '/usr/bin:/bin:/usr/sbin:/sbin';

40const safePath = currentPath.includes(nodeBinDir) ? currentPath : `${nodeBinDir}:${currentPath}`;

41const safeEnv = { ...process.env, PATH: safePath };

42export const PUBLIC_NPM_REGISTRY = 'https://registry.npmjs.org/';

43

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

connection/upgrade.jsView on unpkg · L1

44/**

45 * Build an npm metadata query that bypasses stale local metadata and registry

46 * mirrors. Upgrade decisions must use the package actually published to the

47 * public registry, not a cached `latest` value from a previous release.

48 */

connection/upgrade-worker-template.jsView file

Lines 1-21javascript

1'use strict';

2const fs = require('fs');

3const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

yeaft/tools/js-repl.jsView file

Lines 1-21javascript

1/**

2 * js-repl.js — JavaScript REPL for evaluating expressions.

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

yeaft/tools/js-repl.jsView on unpkg · L1

3 *

4 * Runs JavaScript code in a persistent VM context, allowing

5 * state to be maintained across calls.

6 *

7 * task-333b: merged the former `JsReplReset` tool into this one as a

8 * `reset: true` parameter. A single tool with a reset flag eliminates a

9

service/windows.jsView file

Lines 1-39javascript

1/*

2 * Service — Windows (pm2) platform implementation

3 */

4import { execSync, spawn } from 'child_process';

5import { existsSync, mkdirSync, writeFileSync, readFileSync, unlinkSync } from 'fs';

6import { join, dirname } from 'path'

cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @yeaft/webchat-agent@1.0.118 matchedIdentity = npm:QHllYWZ0L3dlYmNoYXQtYWdlbnQ:1.0.118 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli.jsView on unpkg