Loading npm security reports…

@yeaft/webchat-agent@1.0.300: Malicious npm security report | LPM Firewall

registry / @yeaft/webchat-agent / 1.0.300

@yeaft/webchat-agent@1.0.300

Remote worker agent for Yeaft Web Code Agent — connects the native Yeaft engine, CLI providers, and workbench tools

OSV Malicious Advisory

scanned 9d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-10723 confirms this npm version as malicious. The package installs itself as a user-level service (systemd on Linux via service/linux.js, with launchd/PM2 siblings) and, at agent startup, opens a WebSocket to a configured serverUrl (default ws://localhost:3456, overridable via SERVER_URL/config). The WebSocket message router in connection/message-router.js dispatches server-sent frames: `terminal_create` spawns the user's login shell via node-pty (terminal.js:...

Advisory

MAL-2026-10723

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @yeaft/webchat-agent (npm)

Details

The package installs itself as a user-level service (systemd on Linux via service/linux.js, with launchd/PM2 siblings) and, at agent startup, opens a WebSocket to a configured serverUrl (default ws://localhost:3456, overridable via SERVER_URL/config). The WebSocket message router in connection/message-router.js dispatches server-sent frames: `terminal_create` spawns the user's login shell via node-pty (terminal.js: `pty.spawn(shell,...)`) in the agent's workDir, and `terminal_input` writes the server's `msg.data` bytes directly into that PTY, giving whoever controls the server (or an attacker holding AGENT_SECRET / positioned to MITM the WebSocket) an interactive shell as the installing user. An `upgrade_agent` message handled by connection/upgrade.js runs `npm install @yeaft/webchat-agent@latest --registry=https://pkg.yeaft.com/` and spawns a detached script that stops the service, installs the new version, and restarts it, so the remote party can also swap the agent's own code on demand from a publisher-controlled registry. On every startup, index.js additionally git-clones https://github.com/yeaft/yeaft-skills.git from the mutable `main` branch into ~/.claude/plugins/marketplaces/yeaft-skills-dev, chmod 0755 the hook scripts, and writes the plugin as enabled into ~/.claude/settings.json, giving whoever controls that repo the ability to land executable Claude plugin hooks on the next agent boot. The service/linux.js unit also prepends ~/.local/bin and ~/.npm-global/bin to PATH in the service environment. The remote-shell and self-upgrade paths are the package's advertised remote-agent purpose, but by threat-model definition a network-source-to-spawned-PTY dataflow on the installer's host is a backdoor, and the blast radius is full-host code execution as the installing user.

Source & flagged code

11 flagged · loading source

connection/upgrade.jsView file

1import { execFile, execFileSync, spawn } from 'child_process'; L2: import { writeFileSync, mkdirSync, existsSync } from 'fs';

High

Child Process

Package source references child process execution.

connection/upgrade.jsView on unpkg · L1

33const isWin = platform() === 'win32'; L34: // Windows: use bare 'npm'/'pm2' + shell:true — cmd.exe finds them via PATH. L35: // This was the working pattern before ce58bbc. Absolute paths break when

High

Shell

Package source references shell execution.

connection/upgrade.jsView on unpkg · L33

1import { execFile, execFileSync, spawn } from 'child_process'; L2: import { writeFileSync, mkdirSync, existsSync } from 'fs'; ... L25: export function resolveInstanceId() { L26: return ctx.CONFIG?.instanceId || process.env.YEAFT_AGENT_INSTANCE || DEFAULT_INSTANCE_ID; L27: } ... L33: const isWin = platform() === 'win32'; L34: // Windows: use bare 'npm'/'pm2' + shell:true — cmd.exe finds them via PATH. L35: // This was the working pattern before ce58bbc. Absolute paths break when ... L61: // Shared cleanup logic for restart/upgrade L62: function cleanupAndExit(exitCode) { L63: setTimeout(async () => { ... L430: const serviceName = getServiceName(instanceId);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

connection/upgrade.jsView on unpkg · L1

local-runtime/web/jszip.min.jsView file

12L13: !function(e){if("object"==typeof exports&&"undefined"!=typeof module)module.exports=e();else if("function"==typeof define&&define.amd)define([],e);else{("undefined"!=typeof window?...

Low

Eval

Package source references a known benign dynamic code generation pattern.

local-runtime/web/jszip.min.jsView on unpkg · L12

local-runtime/web/docx-preview.min.jsView file

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("jszip")):"function"==typeof define&&define.amd?define(["exports","jszip"],t):t((e="undefined"... L2: //# sourceMappingURL=docx-preview.min.js.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

local-runtime/web/docx-preview.min.jsView on unpkg · L1

yeaft/tools/js-repl.jsView file

1/** L2: * js-repl.js — JavaScript REPL for evaluating expressions.

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

yeaft/tools/js-repl.jsView on unpkg · L1

local-run.jsView file

1import { spawn } from 'child_process'; L2: import { existsSync } from 'fs'; L3: import { homedir } from 'os'; L4: import { createServer } from 'net'; L5: import { dirname, join } from 'path'; ... L12: L13: export function parseLocalArgs(args, env = process.env) { L14: const options = { name: resolveDisplayName(args, env), port: DEFAULT_PORT };

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

local-run.jsView on unpkg · L1

service/macos.jsView file

3Trigger-reachable persistence chain: manifest.main -> index.js -> service.js -> service/index.js -> service/macos.js L3: */ L4: import { execSync } from 'child_process'; L5: import { existsSync, writeFileSync, unlinkSync, mkdirSync } from 'fs'; ... L11: export function getLaunchdPlistPath(instanceId = DEFAULT_INSTANCE_ID) { L12: return join(homedir(), 'Library', 'LaunchAgents', `${getLaunchdLabel(instanceId)}.plist`); L13: } ... L70: if (existsSync(plistPath)) { L71: try { execSync(`launchctl unload ${plistPath} 2>/dev/null`); } catch {} L72: } ... L116: * Query launchd for the current service status. L117: * Returns { running: boolean, pid: string|null, exitCode: string|null }. L118: */

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

service/macos.jsView on unpkg · L3

local-runtime/web/xlsx.min.js.gzView file

•path = local-runtime/web/xlsx.min.js.gz kind = high_entropy_blob sizeBytes = 335014 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

local-runtime/web/xlsx.min.js.gzView on unpkg

•path = local-runtime/web/xlsx.min.js.gz kind = compressed_blob sizeBytes = 335014 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

local-runtime/web/xlsx.min.js.gzView on unpkg

cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @yeaft/webchat-agent@1.0.118 matchedIdentity = npm:QHllYWZ0L3dlYmNoYXQtYWdlbnQ:1.0.118 similarity = 0.458 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli.jsView on unpkg

Source & flagged code

11 flagged

connection/upgrade.jsView file

Lines 1-53javascript

1import { execFile, execFileSync, spawn } from 'child_process';

2import { writeFileSync, mkdirSync, existsSync } from 'fs';

High

Child Process

Package source references child process execution.

connection/upgrade.jsView on unpkg · L1

3import { join, dirname } from 'path';

4import { platform, homedir } from 'os';

5import ctx from '../context.js';

6import { getConfigDir, getServiceName, getPm2AppName, getLaunchdPlistPath, DEFAULT_INSTANCE_ID } from '../service.js';

7import {

8 buildUpgradeInstallCommand,

9 buildUpgradeMetadataArgs,

10 buildUpgradeUpdateCommand,

11 launchWindowsUpgradeScript,

12} from '../upgrade-command.js';

13import { sendToServer } from './buffer.js';

14import { stopAgentHeartbeat } from './heartbeat.js';

15

16/**

17 * Resolve the local service instance id for this running agent. Each agent

18 * process is pinned to one instance (set in index.js from

19 * YEAFT_AGENT_INSTANCE / config), so the upgrade flow must target THAT

20 * instance's service unit — not the bare `yeaft-agent` default. Without this,

21 * a named instance (e.g. `server-e7a9eb`) installs the new package but its

22 * systemd unit `yeaft-agent@server-e7a9eb` is never restarted, leaving the

23 * agent permanently offline after a UI-triggered upgrade.

24 */

25export function resolveInstanceId() {

26 return ctx.CONFIG?.instanceId || process.env.YEAFT_AGENT_INSTANCE || DEFAULT_INSTANCE_ID;

27}

28

29// Derive absolute paths for npm/pm2 from current node executable.

30// In launchd/systemd environments, PATH may not include nvm/node dirs,

31// but process.execPath always points to the running node binary.

32const nodeBinDir = dirname(process.execPath);

33const isWin = platform() === 'win32';

34// Windows: use bare 'npm'/'pm2' + shell:true — cmd.exe finds them via PATH.

35// This was the working pattern before ce58bbc. Absolute paths break when

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

connection/upgrade.jsView on unpkg · L1

High

Shell

Package source references shell execution.

connection/upgrade.jsView on unpkg · L33

36// the path contains spaces (e.g., "C:\Program Files\nodejs\npm.cmd").

37// macOS/Linux: use absolute path — launchd/systemd have minimal PATH.

38const npmPath = isWin ? 'npm' : join(nodeBinDir, 'npm');

39const pm2Path = isWin ? 'pm2' : join(nodeBinDir, 'pm2');

40const shellOpt = isWin ? { shell: true, windowsHide: true } : {};

41

42// Ensure PATH includes nodeBinDir so that `#!/usr/bin/env node` shebangs

43// can locate node in launchd/systemd environments with minimal PATH.

44const currentPath = process.env.PATH || '/usr/bin:/bin:/usr/sbin:/sbin';

45const safePath = currentPath.includes(nodeBinDir) ? currentPath : `${nodeBinDir}:${currentPath}`;

46const safeEnv = { ...process.env, PATH: safePath };

47

48/** Return true only when `latestVersion` is semantically newer. */

49export function isUpgradeAvailable(currentVersion, latestVersion) {

50 const current = parseSemver(currentVersion);

51 const latest = parseSemver(latestVersion);

52 if (!current || !latest) return currentVersion !== latestVersion;

53 return cmpTuple(latest, current) > 0;

local-runtime/web/jszip.min.jsView file

Lines 1-13javascript

1/*!

2

3JSZip v3.10.1 - A JavaScript class for generating and reading zip files

4<http://stuartk.com/jszip>

5

6(c) 2009-2016 Stuart Knightley <stuart [at] stuartk.com>

7Dual licenced under the MIT license or GPLv3. See https://raw.github.com/Stuk/jszip/main/LICENSE.markdown.

8

9JSZip uses the library pako released under the MIT license :

10https://github.com/nodeca/pako/blob/main/LICENSE

11*/

12

local-runtime/web/docx-preview.min.jsView file

Lines 1-3javascript

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("jszip")):"function"==typeof define

yeaft/tools/js-repl.jsView file

Lines 1-21javascript

1/**

2 * js-repl.js — JavaScript REPL for evaluating expressions.

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

yeaft/tools/js-repl.jsView on unpkg · L1

3 *

4 * Runs JavaScript code in a persistent VM context, allowing

5 * state to be maintained across calls.

6 *

7 * task-333b: merged the former `JsReplReset` tool into this one as a

8 * `reset: true` parameter. A single tool with a reset flag eliminates a

9

local-run.jsView file

Lines 1-21javascript

1import { spawn } from 'child_process';

2import { existsSync } from 'fs';

3import { homedir } from 'os';

4import { createServer } from 'net';

service/macos.jsView file

Lines 1-23javascript

1/*

2 * Service — macOS (launchd) platform implementation

3 */

4import { execSync } from 'child_process';

5import { existsSync, writeFileSync, unlinkSync, mkdirSync } from 'fs';

6import { join } from 'path';

local-runtime/web/xlsx.min.js.gzView file

•path = local-runtime/web/xlsx.min.js.gz kind = high_entropy_blob sizeBytes = 335014 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

local-runtime/web/xlsx.min.js.gzView on unpkg

•path = local-runtime/web/xlsx.min.js.gz kind = compressed_blob sizeBytes = 335014 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

local-runtime/web/xlsx.min.js.gzView on unpkg

cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @yeaft/webchat-agent@1.0.118 matchedIdentity = npm:QHllYWZ0L3dlYmNoYXQtYWdlbnQ:1.0.118 similarity = 0.458 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli.jsView on unpkg