beast-agent@0.26.5: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

beast-agent@0.26.5: Suspicious npm security report (Warn) | LPM Firewall

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The install hook invokes a repair script that can remove Electron files and run Electron's installer.
The repair script retries a binary download through a mirror and executes the dependency installer.
The agent exposes unrestricted PowerShell command execution and the approval gate is disabled by default.
On first Python use, it downloads an embedded runtime and extracts it before executing Python.
The skill store fetches remote skill content and writes it into the application's skill directory.

Evidence against

No runtime dependency on beast-agent itself is declared.
The install hook targets the bundled Electron dependency, not a foreign AI-agent configuration surface.
The Python download and command tools are application capabilities rather than hidden import-time behavior.
HTTP fetches reject local and private-network hosts.
Messaging inputs are gated by configured allow lists; an empty list permits nobody.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 57 file(s), 1.04 MB of source, external domains: 10.0.0.5, 127.0.0.1, 169.254.169.254, 172.16.0.1, 172.31.255.255, 192.168.1.1, a.b, a.com, a.test, api.anthropic.com, api.exa.ai, api.example.com, api.github.com, api.groq.com, api.openai.com, api.search.tinyfish.ai, api.telegram.org, api.x.com, api.z.ai, b.com, c.com, connectivitycheck.gstatic.com, cp.cloudflare.com, direct.com, discord.com, duckduckgo.com, example.com, generativelanguage.googleapis.com, github.com, html.duckduckgo.com, integrate.api.nvidia.com, npmmirror.com, opencode.ai, openrouter.ai, pc.local, raw.githubusercontent.com, registry.npmjs.org, www.b.com, www.example.com, www.google.com, www.msftconnecttest.com, www.npmjs.com, www.python.org, x.com, y.com, z.com

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-electron.js --soft

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/fix-electron.js --soft

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/beast-agent.jsView file

7L8: const { spawn, spawnSync } = require('child_process'); L9: const path = require('path');

High

Child Process

Package source references child process execution.

bin/beast-agent.jsView on unpkg · L7

7L8: const { spawn, spawnSync } = require('child_process'); L9: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/beast-agent.jsView on unpkg · L7

src/agent/engine.jsView file

1219'- Kodu ve dosyaları DOĞRUDAN write_file ile yaz/güncelle. Basit dosya oluşturma/düzenleme için asla Python scripti yazma; python_run yalnız gerçek hesap/veri işleme gerekiyorsa.\n... L1220: '- Kurulum, test, build, git gibi işler için run_command kullan (Windows PowerShell ortamı).\n' + L1221: '- Bağımsız araç çağrılarını AYNI TURDA paralel ver.\n' +

High

Shell

Package source references shell execution.

src/agent/engine.jsView on unpkg · L1219

src/agent/store.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. src/agent/store.js: const COMMUNITY_URL = 'https://raw.githubusercontent.com/algokodcom/beast-agent/main/store/skills.json'; const SKIP_DIRS = new Set(['node_modules', '.git', '__pycache__', '.drafts']); fs.writeFileSync(p, JSON.stringify(obj, null, 2)); fs.writeFileSync(target, String(content ?? ''), 'utf8');

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

src/agent/store.jsView on unpkg

src/main.jsView file

5const fs = require('fs'); L6: const http = require('http'); L7: const dns = require('dns'); L8: const crypto = require('crypto'); L9: const { spawn } = require('child_process'); L10: const Engine = require('./agent/engine'); ... L57: if (res.ok) { L58: const j = await res.json(); L59: const v = String(j.version || '').trim(); ... L68: if (win && !win.isDestroyed()) { L69: win.webContents.send('agent:event', { type: 'update', ...updateState, current: app.getVersion() }); L70: }

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/main.jsView on unpkg · L5

5Trigger-reachable chain: manifest.main -> src/main.js L5: const fs = require('fs'); L6: const http = require('http'); L7: const dns = require('dns'); L8: const crypto = require('crypto'); L9: const { spawn } = require('child_process'); L10: const Engine = require('./agent/engine'); ... L57: if (res.ok) { L58: const j = await res.json(); L59: const v = String(j.version || '').trim(); ... L68: if (win && !win.isDestroyed()) { L69: win.webContents.send('agent:event', { type: 'update', ...updateState, current: app.getVersion() }); L70: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/main.jsView on unpkg · L5

5const fs = require('fs'); L6: const http = require('http'); L7: const dns = require('dns'); L8: const crypto = require('crypto'); L9: const { spawn } = require('child_process'); L10: const Engine = require('./agent/engine'); ... L57: if (res.ok) { L58: const j = await res.json(); L59: const v = String(j.version || '').trim(); ... L68: if (win && !win.isDestroyed()) { L69: win.webContents.send('agent:event', { type: 'update', ...updateState, current: app.getVersion() }); L70: }

bin/beast-agent.js#virtual:normalized:round1View file

29L30: /* güncelleme modu: çalışan Beast"i kapat (dosya kilidi EBUSY vermesin) → npm güncelle (görünür ilerleme) → yeniden başlat.\n Bu komut güncelleme butonu tarafından GÖRÜNÜR bir cm... L31: detached: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/beast-agent.js#virtual:normalized:round1View on unpkg · L29

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/beast-agent.js#virtual:normalized:round1View on unpkg

src/agent/scripts/websearch.pyView file

•path = src/agent/scripts/websearch.py kind = build_helper sizeBytes = 7583 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/agent/scripts/websearch.pyView on unpkg

eng.traineddataView file

•path = eng.traineddata kind = high_entropy_blob sizeBytes = 5199098 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

eng.traineddataView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 16-56json

16 "keywords": [

17 "agent",

18 "ai",

19 "whatsapp",

20 "assistant",

21 "electron",

22 "windows",

23 "llm",

24 "openai"

25 ],

26 "main": "src/main.js",

27 "bin": {

28 "beast-agent": "bin/beast-agent.js",

29 "beast": "bin/beast-agent.js"

30 },

31 "scripts": {

32 "start": "electron .",

33 "dist": "electron-builder --win nsis portable",

34 "test": "node --test \"tests/**/*.test.js\"",

35 "release": "node scripts/release.js",

36 "postinstall": "node scripts/fix-electron.js --soft",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 "prepublishOnly": "node scripts/swap-electron.js deps",

38 "postpublish": "node scripts/swap-electron.js devdeps"

39 },

40 "devDependencies": {

41 "electron-builder": "^26.15.3"

42 },

43 "dependencies": {

44 "@pdf-lib/fontkit": "^1.1.1",

45 "@whiskeysockets/baileys": "^7.0.0-rc14",

46 "@xenova/transformers": "^2.17.2",

47 "electron-updater": "^6.8.9",

48 "ffmpeg-static": "^5.3.0",

49 "imapflow": "^1.7.6",

50 "nodemailer": "^9.0.5",

51 "pdf-lib": "^1.17.1",

52 "pdf-parse": "^2.4.5",

53 "pdf-to-img": "^6.3.0",

54 "pdfjs-dist": "^5.6.205",

55 "pdfkit": "^0.20.1",

56 "qrcode": "^1.5.4",

bin/beast-agent.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

3

4/* Beast Agent global npm başlatıcısı (`beast` kısa adı da aynı scripte bağlı):

5 `beast` / `beast-agent` → uygulamayı detached başlatır, terminali hemen serbest bırakır

6 `beast update` → npm'den en son sürümü yükler (uygulama kapalıyken çalıştır) */

7

8const { spawn, spawnSync } = require(

src/agent/engine.jsView file

Lines 1199-1239javascript

1199 }

1200 this.emit({ type: 'sessions' });

1201 return true;

1202 }

1203

1204 /* ---------- prompt assembly (the frugal part) ---------- */

1205

1206

src/agent/store.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. src/agent/store.js: const COMMUNITY_URL = 'https://raw.githubusercontent.com/algokodcom/beast-agent/main/store/skills.json'; const SKIP_DIRS = new Set(['node_modules', '.git', '__pycache__', '.drafts']); fs.writeFileSync(p, JSON.stringify(obj, null, 2)); fs.writeFileSync(target, String(content ?? ''), 'utf8');

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

src/agent/store.jsView on unpkg

src/main.jsView file

Lines 1-25javascript

1'use strict';

2

3const { app, BrowserWindow, WebContentsView, ipcMain, shell, dialog, Tray, Menu, nativeImage, desktopCapturer, session,

bin/beast-agent.js#virtual:normalized:round1View file

29L30: /* güncelleme modu: çalışan Beast"i kapat (dosya kilidi EBUSY vermesin) → npm güncelle (görünür ilerleme) → yeniden başlat.\n Bu komut güncelleme butonu tarafından GÖRÜNÜR bir cm... L31: detached: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/beast-agent.js#virtual:normalized:round1View on unpkg · L29

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/beast-agent.js#virtual:normalized:round1View on unpkg

src/agent/scripts/websearch.pyView file

•path = src/agent/scripts/websearch.py kind = build_helper sizeBytes = 7583 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/agent/scripts/websearch.pyView on unpkg

eng.traineddataView file

•path = eng.traineddata kind = high_entropy_blob sizeBytes = 5199098 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

eng.traineddataView on unpkg