@yeaft/webchat-agent@1.0.386: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@yeaft/webchat-agent@1.0.386: Suspicious npm security report | LPM Firewall

Decision evidence

public snapshot

AI called this Suspicious at 95.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

index.js automatically clones and updates a GitHub repository on agent startup.
index.js writes ~/.claude plugin marketplace, installation, and settings records, enabling yeaft-skills.
index.js makes cloned plugin hook files executable.
connection/upgrade.js accepts a WebSocket upgrade_agent message and installs a newer package from the Yeaft registry.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle hook.
The service persistence paths are only reached through explicit yeaft-agent install commands.
The foreign Claude-plugin mutation occurs at agent runtime, not during npm installation.
Upgrade source and registry are fixed to Yeaft-owned package identifiers/endpoints in source.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 358 file(s), 8.43 MB of source, external domains: 127.0.0.1, 169.254.169.254, accounts.google.com, aka.ms, api.anthropic.com, api.deepseek.com, api.github.com, api.githubcopilot.com, api.openai.com, api.tavily.com, api.weixin.qq.com, azuread.github.io, docs.microsoft.com, docs.oasis-open.org, duckduckgo.com, en.wikipedia.org, engelschall.com, generativelanguage.googleapis.com, github.com, html.duckduckgo.com, jquery.org, lodash.com, login.chinacloudapi.cn, login.microsoftonline.com, login.microsoftonline.de, login.microsoftonline.us, login.partner.microsoftonline.cn, login.windows-ppe.net, models.dev, nodejs.org, oauth2.googleapis.com, open.weixin.qq.com, openapi.alipay.com, openauth.alipay.com, openjsf.org, openoffice.org, opensource.org, pkg.yeaft.com, purl.oclc.org, purl.org, schemas.microsoft.com, schemas.openxmlformats.org, sheetjs.com, stuk.github.io, tavily.com, tldrlegal.com, tools.ietf.org, underscorejs.org, view.officeapps.live.com, vuejs.org

Oversized source lightweight scan

local-runtime/web/mermaid.min.js2.75 MB file, sampled 256 KB

ChildProcessHighEntropyStringsMinifiedUrlStringsen.wikipedia.orgengelschall.comgithub.comjquery.orglodash.comopenjsf.orgopensource.orgtldrlegal.comunderscorejs.orgwww.w3.org

Source & flagged code

11 flagged · loading source

windows-upgrade-runner.jsView file

1import { appendFileSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'; L2: import { spawn } from 'node:child_process'; L3: import { dirname } from 'node:path';

High

Child Process

Package source references child process execution.

windows-upgrade-runner.jsView on unpkg · L1

connection/upgrade.jsView file

38const isWin = platform() === 'win32'; L39: // Windows: use bare 'npm'/'pm2' + shell:true — cmd.exe finds them via PATH. L40: // This was the working pattern before ce58bbc. Absolute paths break when

High

Shell

Package source references shell execution.

connection/upgrade.jsView on unpkg · L38

1import { execFile, execFileSync, spawn } from 'child_process'; L2: import { writeFileSync, mkdirSync, existsSync } from 'fs'; ... L30: export function resolveInstanceId() { L31: return ctx.CONFIG?.instanceId || process.env.YEAFT_AGENT_INSTANCE || DEFAULT_INSTANCE_ID; L32: } ... L38: const isWin = platform() === 'win32'; L39: // Windows: use bare 'npm'/'pm2' + shell:true — cmd.exe finds them via PATH. L40: // This was the working pattern before ce58bbc. Absolute paths break when ... L61: // Shared cleanup logic for restart/upgrade L62: function cleanupAndExit(exitCode) { L63: setTimeout(async () => { ... L399: const serviceName = getServiceName(instanceId);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

connection/upgrade.jsView on unpkg · L1

local-runtime/web/jszip.min.jsView file

12L13: !function(e){if("object"==typeof exports&&"undefined"!=typeof module)module.exports=e();else if("function"==typeof define&&define.amd)define([],e);else{("undefined"!=typeof window?...

Low

Eval

Package source references a known benign dynamic code generation pattern.

local-runtime/web/jszip.min.jsView on unpkg · L12

local-runtime/web/docx-preview.min.jsView file

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("jszip")):"function"==typeof define&&define.amd?define(["exports","jszip"],t):t((e="undefined"... L2: //# sourceMappingURL=docx-preview.min.js.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

local-runtime/web/docx-preview.min.jsView on unpkg · L1

yeaft/tools/js-repl.jsView file

1/** L2: * js-repl.js — JavaScript REPL for evaluating expressions.

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

yeaft/tools/js-repl.jsView on unpkg · L1

local-run.jsView file

1import { spawn } from 'child_process'; L2: import { existsSync } from 'fs'; L3: import { homedir } from 'os'; L4: import { createServer } from 'net'; L5: import { dirname, join } from 'path'; ... L12: L13: export function parseLocalArgs(args, env = process.env) { L14: const options = {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

local-run.jsView on unpkg · L1

service/macos.jsView file

3Trigger-reachable persistence chain: scripts.start -> index.js -> service.js -> service/index.js -> service/macos.js L3: */ L4: import { execSync } from 'child_process'; L5: import { existsSync, writeFileSync, unlinkSync, mkdirSync } from 'fs'; ... L11: export function getLaunchdPlistPath(instanceId = DEFAULT_INSTANCE_ID) { L12: return join(homedir(), 'Library', 'LaunchAgents', `${getLaunchdLabel(instanceId)}.plist`); L13: } ... L70: if (existsSync(plistPath)) { L71: try { execSync(`launchctl unload ${plistPath} 2>/dev/null`); } catch {} L72: } ... L116: * Query launchd for the current service status. L117: * Returns { running: boolean, pid: string|null, exitCode: string|null }. L118: */

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

service/macos.jsView on unpkg · L3

local-runtime/web/xlsx.min.js.gzView file

•path = local-runtime/web/xlsx.min.js.gz kind = high_entropy_blob sizeBytes = 335014 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

local-runtime/web/xlsx.min.js.gzView on unpkg

•path = local-runtime/web/xlsx.min.js.gz kind = compressed_blob sizeBytes = 335014 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

local-runtime/web/xlsx.min.js.gzView on unpkg

index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @yeaft/webchat-agent@1.0.385 matchedIdentity = npm:QHllYWZ0L3dlYmNoYXQtYWdlbnQ:1.0.385 similarity = 0.883 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

Source & flagged code

11 flagged

windows-upgrade-runner.jsView file

Lines 1-21javascript

1import { appendFileSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';

2import { spawn } from 'node:child_process';

3import { dirname } from 'node:path';

High

Child Process

Package source references child process execution.

windows-upgrade-runner.jsView on unpkg · L1

4import { pathToFileURL } from 'node:url';

5import { setTimeout as delay } from 'node:timers/promises';

6import {

7 buildUpgradeInstallArgs,

8 releaseWindowsUpgradeLock,

9 resolveWindowsNpmCliPath,

10} from './upgrade-command.js';

11

12const PID_POLL_INTERVAL_MS = 100;

13const PID_WAIT_TIMEOUT_MS = 30_000;

14const HANDOFF_AUTH_TIMEOUT_MS = 15_000;

15const FILE_LOCK_RETRY_MS = [0, 250, 750, 1_500];

16const PM2_RETRY_MS = [0, 250, 750];

17

18function appendLog(logPath, message) {

19 try {

20 appendFileSync(logPath, `[Upgrade] ${message}\n`);

21 } catch {}

connection/upgrade.jsView file

Lines 1-58javascript

1import { execFile, execFileSync, spawn } from 'child_process';

2import { writeFileSync, mkdirSync, existsSync } from 'fs';

3import { fileURLToPath } from 'url';

4import { join, dirname } from 'path';

local-runtime/web/jszip.min.jsView file

Lines 1-13javascript

1/*!

2

3JSZip v3.10.1 - A JavaScript class for generating and reading zip files

4<http://stuartk.com/jszip>

5

6(c) 2009-2016 Stuart Knightley <stuart [at] stuartk.com>

7Dual licenced under the MIT license or GPLv3. See https://raw.github.com/Stuk/jszip/main/LICENSE.markdown.

8

9JSZip uses the library pako released under the MIT license :

10https://github.com/nodeca/pako/blob/main/LICENSE

11*/

12

local-runtime/web/docx-preview.min.jsView file

Lines 1-3javascript

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("jszip")):"function"==typeof define

yeaft/tools/js-repl.jsView file

Lines 1-21javascript

1/**

2 * js-repl.js — JavaScript REPL for evaluating expressions.

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

yeaft/tools/js-repl.jsView on unpkg · L1

3 *

4 * Runs JavaScript code in a persistent VM context, allowing

5 * state to be maintained across calls.

6 *

7 * task-333b: merged the former `JsReplReset` tool into this one as a

8 * `reset: true` parameter. A single tool with a reset flag eliminates a

9

local-run.jsView file

Lines 1-21javascript

1import { spawn } from 'child_process';

2import { existsSync } from 'fs';

3import { homedir } from 'os';

4import { createServer } from 'net';

service/macos.jsView file

Lines 1-23javascript

1/*

2 * Service — macOS (launchd) platform implementation

3 */

4import { execSync } from 'child_process';

5import { existsSync, writeFileSync, unlinkSync, mkdirSync } from 'fs';

6import { join } from 'path';

local-runtime/web/xlsx.min.js.gzView file

•path = local-runtime/web/xlsx.min.js.gz kind = high_entropy_blob sizeBytes = 335014 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

local-runtime/web/xlsx.min.js.gzView on unpkg

•path = local-runtime/web/xlsx.min.js.gz kind = compressed_blob sizeBytes = 335014 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

local-runtime/web/xlsx.min.js.gzView on unpkg

index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @yeaft/webchat-agent@1.0.385 matchedIdentity = npm:QHllYWZ0L3dlYmNoYXQtYWdlbnQ:1.0.385 similarity = 0.883 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg