beast-agent@0.25.3: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

beast-agent@0.25.3: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

11 flagged · loading source

bin/beast-agent.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = beast-agent@0.23.2 matchedIdentity = npm:YmVhc3QtYWdlbnQ:0.23.2 similarity = 0.815 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/beast-agent.jsView on unpkg

7L8: const { spawn, spawnSync } = require('child_process'); L9: const path = require('path');

High

Child Process

Package source references child process execution.

bin/beast-agent.jsView on unpkg · L7

src/agent/engine.jsView file

1206'- Kodu ve dosyaları DOĞRUDAN write_file ile yaz/güncelle. Basit dosya oluşturma/düzenleme için asla Python scripti yazma; python_run yalnız gerçek hesap/veri işleme gerekiyorsa.\n... L1207: '- Kurulum, test, build, git gibi işler için run_command kullan (Windows PowerShell ortamı).\n' + L1208: '- Bağımsız araç çağrılarını AYNI TURDA paralel ver.\n' +

High

Shell

Package source references shell execution.

src/agent/engine.jsView on unpkg · L1206

src/agent/store.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. src/agent/store.js: const COMMUNITY_URL = 'https://raw.githubusercontent.com/algokodcom/beast-agent/main/store/skills.json'; const SKIP_DIRS = new Set(['node_modules', '.git', '__pycache__', '.drafts']); fs.writeFileSync(p, JSON.stringify(obj, null, 2)); fs.writeFileSync(target, String(content ?? ''), 'utf8');

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

src/agent/store.jsView on unpkg

src/main.jsView file

5const fs = require('fs'); L6: const http = require('http'); L7: const dns = require('dns'); L8: const crypto = require('crypto'); L9: const { spawn } = require('child_process'); L10: const Engine = require('./agent/engine'); ... L56: if (res.ok) { L57: const j = await res.json(); L58: const v = String(j.version || '').trim(); ... L67: if (win && !win.isDestroyed()) { L68: win.webContents.send('agent:event', { type: 'update', ...updateState, current: app.getVersion() }); L69: }

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/main.jsView on unpkg · L5

5Trigger-reachable chain: manifest.main -> src/main.js L5: const fs = require('fs'); L6: const http = require('http'); L7: const dns = require('dns'); L8: const crypto = require('crypto'); L9: const { spawn } = require('child_process'); L10: const Engine = require('./agent/engine'); ... L56: if (res.ok) { L57: const j = await res.json(); L58: const v = String(j.version || '').trim(); ... L67: if (win && !win.isDestroyed()) { L68: win.webContents.send('agent:event', { type: 'update', ...updateState, current: app.getVersion() }); L69: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/main.jsView on unpkg · L5

5const fs = require('fs'); L6: const http = require('http'); L7: const dns = require('dns'); L8: const crypto = require('crypto'); L9: const { spawn } = require('child_process'); L10: const Engine = require('./agent/engine'); ... L56: if (res.ok) { L57: const j = await res.json(); L58: const v = String(j.version || '').trim(); ... L67: if (win && !win.isDestroyed()) { L68: win.webContents.send('agent:event', { type: 'update', ...updateState, current: app.getVersion() }); L69: }

bin/beast-agent.js#virtual:normalized:round1View file

29L30: /* güncelleme modu: çalışan Beast"i kapat (dosya kilidi EBUSY vermesin) → npm güncelle (görünür ilerleme) → yeniden başlat.\n Bu komut güncelleme butonu tarafından GÖRÜNÜR bir cm... L31: detached: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/beast-agent.js#virtual:normalized:round1View on unpkg · L29

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/beast-agent.js#virtual:normalized:round1View on unpkg

src/agent/scripts/websearch.pyView file

•path = src/agent/scripts/websearch.py kind = build_helper sizeBytes = 7583 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/agent/scripts/websearch.pyView on unpkg

eng.traineddataView file

•path = eng.traineddata kind = high_entropy_blob sizeBytes = 5199098 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

eng.traineddataView on unpkg

Source & flagged code

11 flagged

bin/beast-agent.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

3

4/* Beast Agent global npm başlatıcısı (`beast` kısa adı da aynı scripte bağlı):

5 `beast` / `beast-agent` → uygulamayı detached başlatır, terminali hemen serbest bırakır

6 `beast update` → npm'den en son sürümü yükler (uygulama kapalıyken çalıştır) */

7

8const { spawn, spawnSync } = require('child_process');

9const path = require('path');

High

Child Process

Package source references child process execution.

bin/beast-agent.jsView on unpkg · L7

10const fs = require('fs');

11const os = require('os');

12

13/* kaldırma modu: uygulamayı kaldırır ama KİŞİSEL VERİLERİ korur

14 (%APPDATA%\beast: config.yaml, .env, oturumlar, hafıza, WhatsApp eşlemesi, yedekler) */

15if (process.argv[2] === 'uninstall') {

16 const isWin = process.platform === 'win32';

17 console.log('Beast Agent kald\u0131r\u0131l\u0131yor\u2026');

18 if (isWin) {

19 /* çalışan örnekleri kapat */

20 try {

21 spawnSync('powershell.exe', ['-NoProfile', '-Command',

22 "Get-Process electron -ErrorAction SilentlyContinue | Where-Object { $_.Path -like '*node_modules*beast-agent*' } | Stop-Process -Force"],

23 { stdio: 'ignore' });

24 console.log('\u2022 \u00E7al\u0131\u015Fan Beast kapat\u0131ld\u0131 (varsa)');

25 } catch {}

26 /* startup kaydını sil — yalnız verisi beast-agent'a işaret ediyorsa */

27 try {

•matchType = previous_version_dangerous_delta matchedPackage = beast-agent@0.23.2 matchedIdentity = npm:YmVhc3QtYWdlbnQ:0.23.2 similarity = 0.815 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/beast-agent.jsView on unpkg

src/agent/engine.jsView file

Lines 1186-1226javascript

1186 }

1187 this.emit({ type: 'sessions' });

1188 return true;

1189 }

1190

1191 /* ---------- prompt assembly (the frugal part) ---------- */

1192

1193

src/agent/store.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. src/agent/store.js: const COMMUNITY_URL = 'https://raw.githubusercontent.com/algokodcom/beast-agent/main/store/skills.json'; const SKIP_DIRS = new Set(['node_modules', '.git', '__pycache__', '.drafts']); fs.writeFileSync(p, JSON.stringify(obj, null, 2)); fs.writeFileSync(target, String(content ?? ''), 'utf8');

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

src/agent/store.jsView on unpkg

src/main.jsView file

Lines 1-25javascript

1'use strict';

2

3const { app, BrowserWindow, WebContentsView, ipcMain, shell, dialog, Tray, Menu, nativeImage, desktopCapturer, session,

bin/beast-agent.js#virtual:normalized:round1View file

29L30: /* güncelleme modu: çalışan Beast"i kapat (dosya kilidi EBUSY vermesin) → npm güncelle (görünür ilerleme) → yeniden başlat.\n Bu komut güncelleme butonu tarafından GÖRÜNÜR bir cm... L31: detached: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/beast-agent.js#virtual:normalized:round1View on unpkg · L29

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/beast-agent.js#virtual:normalized:round1View on unpkg

src/agent/scripts/websearch.pyView file

•path = src/agent/scripts/websearch.py kind = build_helper sizeBytes = 7583 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/agent/scripts/websearch.pyView on unpkg

eng.traineddataView file

•path = eng.traineddata kind = high_entropy_blob sizeBytes = 5199098 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

eng.traineddataView on unpkg