@yeaft/webchat-agent@1.0.415: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@yeaft/webchat-agent@1.0.415: Suspicious npm security report | LPM Firewall

Decision evidence

public snapshot

AI called this Suspicious at 95.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

index.js automatically clones and updates a remote skills repository at agent startup.
index.js writes and enables that plugin in ~/.claude/plugins and ~/.claude/settings.json.
connection/message-router.js accepts remote terminal, file, git, proxy, and upgrade operations after WebSocket authentication.

Evidence against

package.json has no preinstall, install, or postinstall hook.
Service persistence is only reached through explicit CLI install commands.
No source evidence of secret harvesting or unrelated exfiltration was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 378 file(s), 8.66 MB of source, external domains: 127.0.0.1, 169.254.169.254, accounts.google.com, aka.ms, api.anthropic.com, api.deepseek.com, api.github.com, api.githubcopilot.com, api.openai.com, api.tavily.com, api.weixin.qq.com, azuread.github.io, docs.microsoft.com, docs.oasis-open.org, duckduckgo.com, en.wikipedia.org, engelschall.com, generativelanguage.googleapis.com, github.com, html.duckduckgo.com, jquery.org, lodash.com, login.chinacloudapi.cn, login.microsoftonline.com, login.microsoftonline.de, login.microsoftonline.us, login.partner.microsoftonline.cn, login.windows-ppe.net, models.dev, nodejs.org, oauth2.googleapis.com, open.weixin.qq.com, openapi.alipay.com, openauth.alipay.com, openjsf.org, openoffice.org, opensource.org, pkg.yeaft.com, purl.oclc.org, purl.org, schemas.microsoft.com, schemas.openxmlformats.org, sheetjs.com, storage.googleapis.com, stuk.github.io, tavily.com, tldrlegal.com, tools.ietf.org, underscorejs.org, view.officeapps.live.com

Oversized source lightweight scan

local-runtime/web/mermaid.min.js2.75 MB file, sampled 256 KB

ChildProcessHighEntropyStringsMinifiedUrlStringsen.wikipedia.orgengelschall.comgithub.comjquery.orglodash.comopenjsf.orgopensource.orgtldrlegal.comunderscorejs.orgwww.w3.org

Source & flagged code

13 flagged · loading source

windows-upgrade-runner.jsView file

1import { appendFileSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'; L2: import { spawn } from 'node:child_process'; L3: import { dirname } from 'node:path';

High

Child Process

Package source references child process execution.

windows-upgrade-runner.jsView on unpkg · L1

connection/upgrade.jsView file

38const isWin = platform() === 'win32'; L39: // Windows: use bare 'npm'/'pm2' + shell:true — cmd.exe finds them via PATH. L40: // This was the working pattern before ce58bbc. Absolute paths break when

High

Shell

Package source references shell execution.

connection/upgrade.jsView on unpkg · L38

1import { execFile, execFileSync, spawn } from 'child_process'; L2: import { writeFileSync, mkdirSync, existsSync } from 'fs'; ... L30: export function resolveInstanceId() { L31: return ctx.CONFIG?.instanceId || process.env.YEAFT_AGENT_INSTANCE || DEFAULT_INSTANCE_ID; L32: } ... L38: const isWin = platform() === 'win32'; L39: // Windows: use bare 'npm'/'pm2' + shell:true — cmd.exe finds them via PATH. L40: // This was the working pattern before ce58bbc. Absolute paths break when ... L61: // Shared cleanup logic for restart/upgrade L62: function cleanupAndExit(exitCode) { L63: setTimeout(async () => { ... L399: const serviceName = getServiceName(instanceId);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

connection/upgrade.jsView on unpkg · L1

local-runtime/web/jszip.min.jsView file

12L13: !function(e){if("object"==typeof exports&&"undefined"!=typeof module)module.exports=e();else if("function"==typeof define&&define.amd)define([],e);else{("undefined"!=typeof window?...

Low

Eval

Package source references a known benign dynamic code generation pattern.

local-runtime/web/jszip.min.jsView on unpkg · L12

local-runtime/web/docx-preview.min.jsView file

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("jszip")):"function"==typeof define&&define.amd?define(["exports","jszip"],t):t((e="undefined"... L2: //# sourceMappingURL=docx-preview.min.js.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

local-runtime/web/docx-preview.min.jsView on unpkg · L1

yeaft/tools/js-repl.jsView file

1/** L2: * js-repl.js — JavaScript REPL for evaluating expressions.

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

yeaft/tools/js-repl.jsView on unpkg · L1

local-run.jsView file

1import { spawn } from 'child_process'; L2: import { existsSync } from 'fs'; L3: import { homedir } from 'os'; L4: import { createServer } from 'net'; L5: import { dirname, join } from 'path'; ... L12: L13: export function parseLocalArgs(args, env = process.env) { L14: const options = {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

local-run.jsView on unpkg · L1

service/macos.jsView file

3Trigger-reachable persistence chain: scripts.start -> index.js -> service.js -> service/index.js -> service/macos.js L3: */ L4: import { execSync } from 'child_process'; L5: import { existsSync, writeFileSync, unlinkSync, mkdirSync } from 'fs'; ... L11: export function getLaunchdPlistPath(instanceId = DEFAULT_INSTANCE_ID) { L12: return join(homedir(), 'Library', 'LaunchAgents', `${getLaunchdLabel(instanceId)}.plist`); L13: } ... L70: if (existsSync(plistPath)) { L71: try { execSync(`launchctl unload ${plistPath} 2>/dev/null`); } catch {} L72: } ... L116: * Query launchd for the current service status. L117: * Returns { running: boolean, pid: string|null, exitCode: string|null }. L118: */

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

service/macos.jsView on unpkg · L3

browser-runtime/windows-version-job.ps1View file

•path = browser-runtime/windows-version-job.ps1 kind = build_helper sizeBytes = 8589 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

browser-runtime/windows-version-job.ps1View on unpkg

local-runtime/web/xlsx.min.js.gzView file

•path = local-runtime/web/xlsx.min.js.gz kind = high_entropy_blob sizeBytes = 335014 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

local-runtime/web/xlsx.min.js.gzView on unpkg

•path = local-runtime/web/xlsx.min.js.gz kind = compressed_blob sizeBytes = 335014 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

local-runtime/web/xlsx.min.js.gzView on unpkg

local-runtime/web/mermaid.min.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

local-runtime/web/mermaid.min.jsView on unpkg

index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @yeaft/webchat-agent@1.0.414 matchedIdentity = npm:QHllYWZ0L3dlYmNoYXQtYWdlbnQ:1.0.414 similarity = 0.942 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

Source & flagged code

13 flagged

windows-upgrade-runner.jsView file

Lines 1-21javascript

1import { appendFileSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';

2import { spawn } from 'node:child_process';

3import { dirname } from 'node:path';

High

Child Process

Package source references child process execution.

windows-upgrade-runner.jsView on unpkg · L1

4import { pathToFileURL } from 'node:url';

5import { setTimeout as delay } from 'node:timers/promises';

6import {

7 buildUpgradeInstallArgs,

8 releaseWindowsUpgradeLock,

9 resolveWindowsNpmCliPath,

10} from './upgrade-command.js';

11

12const PID_POLL_INTERVAL_MS = 100;

13const PID_WAIT_TIMEOUT_MS = 30_000;

14const HANDOFF_AUTH_TIMEOUT_MS = 15_000;

15const FILE_LOCK_RETRY_MS = [0, 250, 750, 1_500];

16const PM2_RETRY_MS = [0, 250, 750];

17

18function appendLog(logPath, message) {

19 try {

20 appendFileSync(logPath, `[Upgrade] ${message}\n`);

21 } catch {}

connection/upgrade.jsView file

Lines 1-58javascript

1import { execFile, execFileSync, spawn } from 'child_process';

2import { writeFileSync, mkdirSync, existsSync } from 'fs';

3import { fileURLToPath } from 'url';

4import { join, dirname } from 'path';

local-runtime/web/jszip.min.jsView file

Lines 1-13javascript

1/*!

2

3JSZip v3.10.1 - A JavaScript class for generating and reading zip files

4<http://stuartk.com/jszip>

5

6(c) 2009-2016 Stuart Knightley <stuart [at] stuartk.com>

7Dual licenced under the MIT license or GPLv3. See https://raw.github.com/Stuk/jszip/main/LICENSE.markdown.

8

9JSZip uses the library pako released under the MIT license :

10https://github.com/nodeca/pako/blob/main/LICENSE

11*/

12

local-runtime/web/docx-preview.min.jsView file

Lines 1-3javascript

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("jszip")):"function"==typeof define

yeaft/tools/js-repl.jsView file

Lines 1-21javascript

1/**

2 * js-repl.js — JavaScript REPL for evaluating expressions.

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

yeaft/tools/js-repl.jsView on unpkg · L1

3 *

4 * Runs JavaScript code in a persistent VM context, allowing

5 * state to be maintained across calls.

6 *

7 * task-333b: merged the former `JsReplReset` tool into this one as a

8 * `reset: true` parameter. A single tool with a reset flag eliminates a

9

local-run.jsView file

Lines 1-21javascript

1import { spawn } from 'child_process';

2import { existsSync } from 'fs';

3import { homedir } from 'os';

4import { createServer } from 'net';

service/macos.jsView file

Lines 1-23javascript

1/*

2 * Service — macOS (launchd) platform implementation

3 */

4import { execSync } from 'child_process';

5import { existsSync, writeFileSync, unlinkSync, mkdirSync } from 'fs';

6import { join } from 'path';

browser-runtime/windows-version-job.ps1View file

•path = browser-runtime/windows-version-job.ps1 kind = build_helper sizeBytes = 8589 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

browser-runtime/windows-version-job.ps1View on unpkg

local-runtime/web/xlsx.min.js.gzView file

•path = local-runtime/web/xlsx.min.js.gz kind = high_entropy_blob sizeBytes = 335014 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

local-runtime/web/xlsx.min.js.gzView on unpkg

•path = local-runtime/web/xlsx.min.js.gz kind = compressed_blob sizeBytes = 335014 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

local-runtime/web/xlsx.min.js.gzView on unpkg

local-runtime/web/mermaid.min.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

local-runtime/web/mermaid.min.jsView on unpkg

index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @yeaft/webchat-agent@1.0.414 matchedIdentity = npm:QHllYWZ0L3dlYmNoYXQtYWdlbnQ:1.0.414 similarity = 0.942 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg