registry / @yeaft/webchat-agent / 1.0.627
@yeaft/webchat-agent@1.0.627
⚠ Under reviewRemote worker agent for Yeaft Web Code Agent — connects the native Yeaft engine, CLI providers, and workbench tools
Static Scan Results
scanned 11d ago · by rust-scannerStatic analysis completed at 97.0% confidence. No malicious behavior was detected; 23 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
15 flagged · loading sourcewindows-upgrade-runner.jsView file
1import { appendFileSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
L2: import { spawn } from 'node:child_process';
L3: import { dirname } from 'node:path';
High
Child Process
Package source references child process execution.
windows-upgrade-runner.jsView on unpkg · L1connection/upgrade.jsView file
42const isWin = platform() === 'win32';
L43: // Windows: use bare 'npm'/'pm2' + shell:true — cmd.exe finds them via PATH.
L44: // This was the working pattern before ce58bbc. Absolute paths break when
High
1Trigger-reachable persistence chain: scripts.start -> index.js -> connection.js -> connection/index.js -> connection/upgrade.js
L1: import { execFile, execFileSync, spawn } from 'child_process';
L2: import { writeFileSync, mkdirSync, existsSync } from 'fs';
...
L34: export function resolveInstanceId() {
L35: return ctx.CONFIG?.instanceId || process.env.YEAFT_AGENT_INSTANCE || DEFAULT_INSTANCE_ID;
L36: }
...
L42: const isWin = platform() === 'win32';
L43: // Windows: use bare 'npm'/'pm2' + shell:true — cmd.exe finds them via PATH.
L44: // This was the working pattern before ce58bbc. Absolute paths break when
...
L65: // Shared cleanup logic for restart/upgrade
L66: function cleanupAndExit(exitCode) {
L67: setTimeout(async () => {
...
L421: const serviceName = getServiceName(instanceId);
Findings
8 High8 Medium7 Low
HighChild Processwindows-upgrade-runner.js
HighShellconnection/upgrade.js
HighSame File Env Network Executionlocal-run.js
HighTrigger Reachable Persistenceconnection/upgrade.js
HighShips High Entropy Bloblocal-runtime/web/xlsx.min.js.gz
HighSemantic Analysis Limitedcontainer-cli.js#virtual:normalized:round1
HighKnown Malware Source Similaritylocal-runtime/web/mermaid.min.js
HighPrevious Version Dangerous Deltayeaft/person/local-memory.js
MediumDynamic Requirelocal-runtime/web/docx-preview.min.js
MediumUnsafe Vm Contextyeaft/tools/js-repl.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @yeaft/webchat-agent@1.0.627.
See all versions of @yeaft/webchat-agent for other recorded verdicts.
- Review the evidence and your use of @yeaft/webchat-agent@1.0.627 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.