@yeaft/webchat-agent@1.0.432: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@yeaft/webchat-agent@1.0.432: Suspicious npm security report | LPM Firewall

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Runtime startup clones/pulls a GitHub skills repository into the user's Claude plugin directory.
Runtime writes Claude marketplace, installed-plugin, and enabled-plugin configuration.
The behavior runs automatically on index.js startup unless YEAFT_SKIP_STARTUP_INSTALLS is set.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle hook.
The mutation is a named Yeaft skills plugin setup, not hidden credential harvesting or destructive activity.
No concrete source evidence of exfiltration or remote payload execution beyond the declared plugin clone/update.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 388 file(s), 8.84 MB of source, external domains: 127.0.0.1, 169.254.169.254, accounts.google.com, aka.ms, api.anthropic.com, api.deepseek.com, api.github.com, api.githubcopilot.com, api.openai.com, api.tavily.com, api.weixin.qq.com, azuread.github.io, docs.microsoft.com, docs.oasis-open.org, duckduckgo.com, en.wikipedia.org, engelschall.com, generativelanguage.googleapis.com, github.com, html.duckduckgo.com, jquery.org, lodash.com, login.chinacloudapi.cn, login.microsoftonline.com, login.microsoftonline.de, login.microsoftonline.us, login.partner.microsoftonline.cn, login.windows-ppe.net, models.dev, nodejs.org, oauth2.googleapis.com, open.weixin.qq.com, openapi.alipay.com, openauth.alipay.com, openjsf.org, openoffice.org, opensource.org, pkg.yeaft.com, purl.oclc.org, purl.org, schemas.microsoft.com, schemas.openxmlformats.org, sheetjs.com, storage.googleapis.com, stuk.github.io, tavily.com, tldrlegal.com, tools.ietf.org, underscorejs.org, view.officeapps.live.com

Oversized source lightweight scan

local-runtime/web/mermaid.min.js2.75 MB file, sampled 256 KB

ChildProcessHighEntropyStringsMinifiedUrlStringsen.wikipedia.orgengelschall.comgithub.comjquery.orglodash.comopenjsf.orgopensource.orgtldrlegal.comunderscorejs.orgwww.w3.org

Source & flagged code

14 flagged · loading source

windows-upgrade-runner.jsView file

1import { appendFileSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'; L2: import { spawn } from 'node:child_process'; L3: import { dirname } from 'node:path';

High

Child Process

Package source references child process execution.

windows-upgrade-runner.jsView on unpkg · L1

connection/upgrade.jsView file

38const isWin = platform() === 'win32'; L39: // Windows: use bare 'npm'/'pm2' + shell:true — cmd.exe finds them via PATH. L40: // This was the working pattern before ce58bbc. Absolute paths break when

High

Shell

Package source references shell execution.

connection/upgrade.jsView on unpkg · L38

1import { execFile, execFileSync, spawn } from 'child_process'; L2: import { writeFileSync, mkdirSync, existsSync } from 'fs'; ... L30: export function resolveInstanceId() { L31: return ctx.CONFIG?.instanceId || process.env.YEAFT_AGENT_INSTANCE || DEFAULT_INSTANCE_ID; L32: } ... L38: const isWin = platform() === 'win32'; L39: // Windows: use bare 'npm'/'pm2' + shell:true — cmd.exe finds them via PATH. L40: // This was the working pattern before ce58bbc. Absolute paths break when ... L61: // Shared cleanup logic for restart/upgrade L62: function cleanupAndExit(exitCode) { L63: setTimeout(async () => { ... L399: const serviceName = getServiceName(instanceId);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

connection/upgrade.jsView on unpkg · L1

local-runtime/web/jszip.min.jsView file

12L13: !function(e){if("object"==typeof exports&&"undefined"!=typeof module)module.exports=e();else if("function"==typeof define&&define.amd)define([],e);else{("undefined"!=typeof window?...

Low

Eval

Package source references a known benign dynamic code generation pattern.

local-runtime/web/jszip.min.jsView on unpkg · L12

local-runtime/web/docx-preview.min.jsView file

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("jszip")):"function"==typeof define&&define.amd?define(["exports","jszip"],t):t((e="undefined"... L2: //# sourceMappingURL=docx-preview.min.js.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

local-runtime/web/docx-preview.min.jsView on unpkg · L1

yeaft/tools/js-repl.jsView file

1/** L2: * js-repl.js — JavaScript REPL for evaluating expressions.

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

yeaft/tools/js-repl.jsView on unpkg · L1

local-runtime/server/browser-runtime-routes.jsView file

23function scopeUsername({ ownerUserId, agentId, browserSessionId, peerId, connectionGeneration, endpointRole, expiresAt }) { L24: const scope = Buffer.from(JSON.stringify({ L25: ownerUserId,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

local-runtime/server/browser-runtime-routes.jsView on unpkg · L23

local-run.jsView file

1import { spawn } from 'child_process'; L2: import { existsSync } from 'fs'; L3: import { homedir } from 'os'; L4: import { createServer } from 'net'; L5: import { dirname, join } from 'path'; ... L12: L13: export function parseLocalArgs(args, env = process.env) { L14: const options = {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

local-run.jsView on unpkg · L1

service/macos.jsView file

3Trigger-reachable persistence chain: scripts.start -> index.js -> service.js -> service/index.js -> service/macos.js L3: */ L4: import { execSync } from 'child_process'; L5: import { existsSync, writeFileSync, unlinkSync, mkdirSync } from 'fs'; ... L11: export function getLaunchdPlistPath(instanceId = DEFAULT_INSTANCE_ID) { L12: return join(homedir(), 'Library', 'LaunchAgents', `${getLaunchdLabel(instanceId)}.plist`); L13: } ... L70: if (existsSync(plistPath)) { L71: try { execSync(`launchctl unload ${plistPath} 2>/dev/null`); } catch {} L72: } ... L116: * Query launchd for the current service status. L117: * Returns { running: boolean, pid: string|null, exitCode: string|null }. L118: */

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

service/macos.jsView on unpkg · L3

browser-runtime/windows-version-job.ps1View file

•path = browser-runtime/windows-version-job.ps1 kind = build_helper sizeBytes = 8589 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

browser-runtime/windows-version-job.ps1View on unpkg

local-runtime/web/xlsx.min.js.gzView file

•path = local-runtime/web/xlsx.min.js.gz kind = high_entropy_blob sizeBytes = 335014 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

local-runtime/web/xlsx.min.js.gzView on unpkg

•path = local-runtime/web/xlsx.min.js.gz kind = compressed_blob sizeBytes = 335014 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

local-runtime/web/xlsx.min.js.gzView on unpkg

local-runtime/web/mermaid.min.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

local-runtime/web/mermaid.min.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.1.11 matchedPath = _bmad/skills/requirements-contract-[redacted].min.js matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.1.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

local-runtime/web/mermaid.min.jsView on unpkg

Source & flagged code

14 flagged

windows-upgrade-runner.jsView file

Lines 1-21javascript

1import { appendFileSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';

2import { spawn } from 'node:child_process';

3import { dirname } from 'node:path';

High

Child Process

Package source references child process execution.

windows-upgrade-runner.jsView on unpkg · L1

4import { pathToFileURL } from 'node:url';

5import { setTimeout as delay } from 'node:timers/promises';

6import {

7 buildUpgradeInstallArgs,

8 releaseWindowsUpgradeLock,

9 resolveWindowsNpmCliPath,

10} from './upgrade-command.js';

11

12const PID_POLL_INTERVAL_MS = 100;

13const PID_WAIT_TIMEOUT_MS = 30_000;

14const HANDOFF_AUTH_TIMEOUT_MS = 15_000;

15const FILE_LOCK_RETRY_MS = [0, 250, 750, 1_500];

16const PM2_RETRY_MS = [0, 250, 750];

17

18function appendLog(logPath, message) {

19 try {

20 appendFileSync(logPath, `[Upgrade] ${message}\n`);

21 } catch {}

connection/upgrade.jsView file

Lines 1-58javascript

1import { execFile, execFileSync, spawn } from 'child_process';

2import { writeFileSync, mkdirSync, existsSync } from 'fs';

3import { fileURLToPath } from 'url';

4import { join, dirname } from 'path';

local-runtime/web/jszip.min.jsView file

Lines 1-13javascript

1/*!

2

3JSZip v3.10.1 - A JavaScript class for generating and reading zip files

4<http://stuartk.com/jszip>

5

6(c) 2009-2016 Stuart Knightley <stuart [at] stuartk.com>

7Dual licenced under the MIT license or GPLv3. See https://raw.github.com/Stuk/jszip/main/LICENSE.markdown.

8

9JSZip uses the library pako released under the MIT license :

10https://github.com/nodeca/pako/blob/main/LICENSE

11*/

12

local-runtime/web/docx-preview.min.jsView file

Lines 1-3javascript

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("jszip")):"function"==typeof define

yeaft/tools/js-repl.jsView file

Lines 1-21javascript

1/**

2 * js-repl.js — JavaScript REPL for evaluating expressions.

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

yeaft/tools/js-repl.jsView on unpkg · L1

3 *

4 * Runs JavaScript code in a persistent VM context, allowing

5 * state to be maintained across calls.

6 *

7 * task-333b: merged the former `JsReplReset` tool into this one as a

8 * `reset: true` parameter. A single tool with a reset flag eliminates a

9

local-runtime/server/browser-runtime-routes.jsView file

Lines 3-43javascript

3import { agents, webClients } from './context.js';

4

5const MAX_ROUTES = 2048;

6const MAX_PEERS = 4096;

7

local-run.jsView file

Lines 1-21javascript

1import { spawn } from 'child_process';

2import { existsSync } from 'fs';

3import { homedir } from 'os';

4import { createServer } from 'net';

service/macos.jsView file

3Trigger-reachable persistence chain: scripts.start -> index.js -> service.js -> service/index.js -> service/macos.js L3: */ L4: import { execSync } from 'child_process'; L5: import { existsSync, writeFileSync, unlinkSync, mkdirSync } from 'fs'; ... L11: export function getLaunchdPlistPath(instanceId = DEFAULT_INSTANCE_ID) { L12: return join(homedir(), 'Library', 'LaunchAgents', `${getLaunchdLabel(instanceId)}.plist`); L13: } ... L70: if (existsSync(plistPath)) { L71: try { execSync(`launchctl unload ${plistPath} 2>/dev/null`); } catch {} L72: } ... L116: * Query launchd for the current service status. L117: * Returns { running: boolean, pid: string|null, exitCode: string|null }. L118: */

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

service/macos.jsView on unpkg · L3

browser-runtime/windows-version-job.ps1View file

•path = browser-runtime/windows-version-job.ps1 kind = build_helper sizeBytes = 8589 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

browser-runtime/windows-version-job.ps1View on unpkg

local-runtime/web/xlsx.min.js.gzView file

•path = local-runtime/web/xlsx.min.js.gz kind = high_entropy_blob sizeBytes = 335014 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

local-runtime/web/xlsx.min.js.gzView on unpkg

•path = local-runtime/web/xlsx.min.js.gz kind = compressed_blob sizeBytes = 335014 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

local-runtime/web/xlsx.min.js.gzView on unpkg

local-runtime/web/mermaid.min.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

local-runtime/web/mermaid.min.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.1.11 matchedPath = _bmad/skills/requirements-contract-[redacted].min.js matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.1.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

local-runtime/web/mermaid.min.jsView on unpkg