@yeaft/webchat-agent@1.0.206: Malicious npm security report | LPM Firewall

Loading npm security reports…

OSV Malicious Advisory

scanned 9d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-10723 confirms this npm version as malicious. The package installs itself as a user-level service (systemd on Linux via service/linux.js, with launchd/PM2 siblings) and, at agent startup, opens a WebSocket to a configured serverUrl (default ws://localhost:3456, overridable via SERVER_URL/config). The WebSocket message router in connection/message-router.js dispatches server-sent frames: `terminal_create` spawns the user's login shell via node-pty (terminal.js:...

Advisory

MAL-2026-10723

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @yeaft/webchat-agent (npm)

Details

The package installs itself as a user-level service (systemd on Linux via service/linux.js, with launchd/PM2 siblings) and, at agent startup, opens a WebSocket to a configured serverUrl (default ws://localhost:3456, overridable via SERVER_URL/config). The WebSocket message router in connection/message-router.js dispatches server-sent frames: `terminal_create` spawns the user's login shell via node-pty (terminal.js: `pty.spawn(shell,...)`) in the agent's workDir, and `terminal_input` writes the server's `msg.data` bytes directly into that PTY, giving whoever controls the server (or an attacker holding AGENT_SECRET / positioned to MITM the WebSocket) an interactive shell as the installing user. An `upgrade_agent` message handled by connection/upgrade.js runs `npm install @yeaft/webchat-agent@latest --registry=https://pkg.yeaft.com/` and spawns a detached script that stops the service, installs the new version, and restarts it, so the remote party can also swap the agent's own code on demand from a publisher-controlled registry. On every startup, index.js additionally git-clones https://github.com/yeaft/yeaft-skills.git from the mutable `main` branch into ~/.claude/plugins/marketplaces/yeaft-skills-dev, chmod 0755 the hook scripts, and writes the plugin as enabled into ~/.claude/settings.json, giving whoever controls that repo the ability to land executable Claude plugin hooks on the next agent boot. The service/linux.js unit also prepends ~/.local/bin and ~/.npm-global/bin to PATH in the service environment. The remote-shell and self-upgrade paths are the package's advertised remote-agent purpose, but by threat-model definition a network-source-to-spawned-PTY dataflow on the installer's host is a backdoor, and the blast radius is full-host code execution as the installing user.

@yeaft/webchat-agent@1.0.206: Malicious npm security report | LPM Firewall

Source & flagged code

12 flagged

local-runtime/server/auth/providers/alipay.jsView file

Lines 12-52javascript

12 */

13import { createSign } from 'crypto';

14import { readFileSync } from 'fs';

15import { CONFIG } from '../../config.js';

16

17export const name = 'alipay';

18

19const GATEWAY = 'https://openapi.alipay.com/gateway.do';

20

21/**

22 * Resolve the configured Alipay private key. Accepts either a PEM string

23 * (containing "BEGIN") or a filesystem path (starts with "/" or "file://").

24 * File mode keeps the secret out of env vars and process listings.

25 */

26function resolvePrivateKey() {

27 const raw = CONFIG.sso.alipay.privateKey || '';

28 if (raw.includes('BEGIN')) return raw;

29 if (raw.startsWith('file://')) return readFileSync(raw.slice(7), 'utf8');

30 if (raw.startsWith('/')) return readFileSync(raw, 'utf8');

31 // Bare base64 — wrap as PKCS#1 (legacy fallback for compactness in env vars).

32 return `-----BEGIN RSA PRIVATE KEY-----\n${raw}\n-----END RSA PRIVATE KEY-----`;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

local-runtime/server/auth/providers/alipay.jsView on unpkg · L32

33}

34

35export function isEnabled() {

36 const c = CONFIG.sso?.alipay;

37 return !!(c?.enabled && c.appId && c.privateKey && c.callbackUrl);

38}

39

40export function getAuthorizeUrl(state /* , intent */) {

41 const c = CONFIG.sso.alipay;

42 const url = new URL('https://openauth.alipay.com/oauth2/publicAppAuthorize.htm');

43 url.searchParams.set('app_id', c.appId);

44 url.searchParams.set('scope', 'auth_user');

45 url.searchParams.set('redirect_uri', c.callbackUrl);

46 url.searchParams.set('state', state);

47 return url.toString();

48}

49

50/**

51 * Build an Alipay request payload, sign it with RSA2, and POST to the gateway.

52 */

32patternName = private_key_rsa severity = critical line = 32 matchedText = return `...--`;

Critical

Secret Pattern

RSA private key in local-runtime/server/auth/providers/alipay.js

local-runtime/server/auth/providers/alipay.jsView on unpkg · L32

connection/upgrade.jsView file

Lines 1-48javascript

1import { execFile, execFileSync, spawn } from 'child_process';

2import { writeFileSync, mkdirSync, existsSync, cpSync } from 'fs';

High

Child Process

Package source references child process execution.

connection/upgrade.jsView on unpkg · L1

3import { join, dirname } from 'path';

4

local-runtime/web/jszip.min.jsView file

Lines 1-13javascript

1/*!

2

3JSZip v3.10.1 - A JavaScript class for generating and reading zip files

4<http://stuartk.com/jszip>

5

6(c) 2009-2016 Stuart Knightley <stuart [at] stuartk.com>

7Dual licenced under the MIT license or GPLv3. See https://raw.github.com/Stuk/jszip/main/LICENSE.markdown.

8

9JSZip uses the library pako released under the MIT license :

10https://github.com/nodeca/pako/blob/main/LICENSE

11*/

12

connection/upgrade-worker-template.jsView file

Lines 1-21javascript

1'use strict';

2const fs = require('fs');

3const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

yeaft/tools/js-repl.jsView file

Lines 1-21javascript

1/**

2 * js-repl.js — JavaScript REPL for evaluating expressions.

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

yeaft/tools/js-repl.jsView on unpkg · L1

3 *

4 * Runs JavaScript code in a persistent VM context, allowing

5 * state to be maintained across calls.

6 *

7 * task-333b: merged the former `JsReplReset` tool into this one as a

8 * `reset: true` parameter. A single tool with a reset flag eliminates a

9

service/windows.jsView file

Lines 1-39javascript

1/*

2 * Service — Windows (pm2) platform implementation

3 */

4import { execSync, spawn } from 'child_process';

5import { existsSync, mkdirSync, writeFileSync, readFileSync, unlinkSync } from 'fs';

6import { join, dirname } from 'path'

local-runtime/web/xlsx.min.js.gzView file

•path = local-runtime/web/xlsx.min.js.gz kind = high_entropy_blob sizeBytes = 335014 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

local-runtime/web/xlsx.min.js.gzView on unpkg

•path = local-runtime/web/xlsx.min.js.gz kind = compressed_blob sizeBytes = 335014 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

local-runtime/web/xlsx.min.js.gzView on unpkg

cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @yeaft/webchat-agent@1.0.118 matchedIdentity = npm:QHllYWZ0L3dlYmNoYXQtYWdlbnQ:1.0.118 similarity = 0.525 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli.jsView on unpkg