registry / Remote code execution / beast-agent / 2.11.0

beast-agent@2.11.0

Ultra-fast local agent shell for Windows.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package contains a real remote-code-execution primitive and broad agent command capability. The absence of a self-dependent install chain and the runtime-only driver trigger support a warning rather than a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A computer_act request when cua-driver is unavailable; npm installation also invokes the Electron repair hook.

Impact

Remote script content can run with the user's privileges, and model tool calls can alter the user's workspace or system.

Mechanism

Remote shell piping and model-directed command execution.

AI rationale

Evidence

package.jsonscripts/fix-electron.jssrc/agent/computeruse.jssrc/agent/tools.jssrc/agent/engine.jsnode_modules/electron/distnode_modules/electron/path.txt%APPDATA%/beast

Network endpoints2

cua.ainpmmirror.com

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Its postinstall hook automatically runs a repair script.
The repair deletes Electron files and executes Electron's installer, which can download a binary from a mirror.
A missing computer-use driver causes a remote shell script to be fetched and executed.
The agent exposes arbitrary PowerShell command execution to its model tool loop.

Evidence against

The manifest has no runtime dependency on another beast-agent release.
The remote driver installer is reached through computer-use functionality, not at npm install time.
Risky model tools have an optional approval gate when configured.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

17 flagged

package.jsonView file

Lines 23-63json

23 "llm",

24 "openai"

25 ],

26 "main": "src/main.js",

27 "preferGlobal": true,

28 "bin": {

29 "beast-agent": "bin/beast-agent.js",

30 "beast": "bin/beast-agent.js"

31 },

32 "files": [

33 "src/**/*",

34 "assets/**/*",

35 "scripts/**/*",

36 "!**/__pycache__/**"

37 ],

38 "scripts": {

39 "start": "electron .",

40 "dist": "electron-builder --win nsis portable",

41 "test": "node --test \"tests/**/*.test.js\"",

42 "release": "node scripts/release.js",

43 "postinstall": "node scripts/fix-electron.js --soft",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "prepublishOnly": "node scripts/swap-electron.js deps",

45 "postpublish": "node scripts/swap-electron.js devdeps"

46 },

47 "devDependencies": {

48 "electron-builder": "^26.15.3"

49 },

50 "dependencies": {

51 "@huggingface/transformers": "3.7.5",

52 "@pdf-lib/fontkit": "^1.1.1",

53 "@whiskeysockets/baileys": "^7.0.0-rc14",

54 "@xenova/transformers": "^2.17.2",

55 "electron-updater": "^6.8.9",

56 "ffmpeg-static": "^5.3.0",

57 "imapflow": "^1.7.6",

58 "nodemailer": "^9.0.5",

59 "pdf-lib": "^1.17.1",

60 "pdf-parse": "^2.4.5",

61 "pdf-to-img": "^6.3.0",

62 "pdfjs-dist": "^5.6.205",

63 "pdfkit": "^0.20.1",

bin/beast-agent.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

4/* Beast Agent global npm başlatıcısı (`beast` kısa adı da aynı scripte bağlı):

5 `beast` / `beast-agent` → uygulamayı detached başlatır, terminali hemen serbest bırakır

6 `beast update` → npm'den en son sürümü yükler (uygulama kapalıyken çalıştır) */

8const { spawn, spawnSync } = require(

src/agent/mem0.jsView file

Lines 9-49javascript

9 - Hibrit arama: 0.65*semantic(cosine) + 0.35*keyword (mem0 semantic+BM25 felsefesi)

10 Her fonksiyon degradasyonlu: embedding yoksa keyword, LLM yoksa hash+cos dedup.

src/agent/searxng.jsView file

Lines 1-35javascript

1'use strict';

3/* SearXNG — yerel metasearch entegrasyonu (github.com/searxng/searxng)

4 SearXNG resmi olarak Linux/Docker hedefler; Windows'ta `import pwd`

5 yüzünden patlar. Bu modül Beast'ın GÖMÜLÜ Python'ına gerçek searxng'yi

6 (GitHub master) kurar + pwd shim'i yazar + 127.0.0.1:8888'de arka planda

7 çalıştırır. Arama zinciri 'searxng' motorunu yalnız AYAKTAYSA kullanır.

9 CLI: beast searxng → gerekirse kur + başlat

10 beast searxng status → durum

src/agent/store.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. src/agent/store.js: const COMMUNITY_URL = 'https://raw.githubusercontent.com/algokodcom/beast-agent/main/store/skills.json'; const SKIP_DIRS = new Set(['node_modules', '.git', '__pycache__', '.drafts']); fs.writeFileSync(p, JSON.stringify(obj, null, 2)); fs.writeFileSync(target, String(content ?? ''), 'utf8');

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

src/agent/store.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = beast-agent@1.2.3 matchedPath = src/agent/store.js matchedIdentity = npm:YmVhc3QtYWdlbnQ:1.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent/store.jsView on unpkg

src/main.jsView file

Lines 1-25javascript

1'use strict';

3const { app, BrowserWindow, WebContentsView, ipcMain, shell, dialog, Tray, Menu, nativeImage, desktopCapturer, session,

src/agent/tools.jsView file

Lines 1-25javascript

1'use strict';

3const fs = require('fs');

4const os = require('os');

5const

src/agent/computeruse.jsView file

8L9: Sürücü: https://github.com/trycua/cua — `cua-driver mcp` stdio MCP sunucusu; L10: el yazımı minimal JSON-RPC 2.0 client'ı (mcp.js ile aynı çerçeve). L11: Binary yoksa eski PowerShell backend'ine düşer (yalnız koordinat + foreground). L12: ... L49: otomatik kurulum asla çalışmaz (tests dahil). */ L50: return !String(process.env.BEAST_CUA_DRIVER_CMD || '').trim(); L51: } ... L56: return new Promise((resolve) => { L57: execFile(driverCmd(), ['--version'], { timeout: 10000, windowsHide: true }, (err, stdout) => { L58: const res = { ... L70: function runInstaller(cb) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/agent/computeruse.jsView on unpkg · L8

bin/beast-agent.js#virtual:normalized:round1View file

29L30: /* güncelleme modu: çalışan Beast"i kapat (dosya kilidi EBUSY vermesin) → npm güncelle (görünür ilerleme) → yeniden başlat.\r\n Bu komut güncelleme butonu tarafından GÖRÜNÜR bir ... L31: detached: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/beast-agent.js#virtual:normalized:round1View on unpkg · L29

src/agent/scripts/websearch.pyView file

•path = src/agent/scripts/websearch.py kind = build_helper sizeBytes = 7808 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/agent/scripts/websearch.pyView on unpkg

src/agent/bus.jsView file

•matchType = normalized_sha256 matchedPackage = beast-agent@1.2.3 matchedPath = src/agent/bus.js matchedIdentity = npm:YmVhc3QtYWdlbnQ:1.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent/bus.jsView on unpkg

src/agent/config.jsView file

•matchType = normalized_sha256 matchedPackage = beast-agent@1.2.3 matchedPath = src/agent/config.js matchedIdentity = npm:YmVhc3QtYWdlbnQ:1.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent/config.jsView on unpkg

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-electron.js --soft

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/fix-electron.js --soft

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/beast-agent.jsView file

7L8: const { spawn, spawnSync } = require('child_process'); L9: const path = require('path');

High

Child Process

Package source references child process execution.

bin/beast-agent.jsView on unpkg · L7

Findings

2 Critical11 High6 Medium6 Low

CriticalDownload Executesrc/agent/tools.js

CriticalTrigger Reachable Dangerous Capabilitysrc/main.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/beast-agent.js

HighSame File Env Network Executionsrc/agent/searxng.js

HighEntrypoint Foreign Package Code Overwritesrc/agent/store.js

HighCommand Output Exfiltrationsrc/main.js

HighSandbox Evasion Gated Capabilitysrc/agent/computeruse.js

HighRuntime Package Installbin/beast-agent.js#virtual:normalized:round1

HighSemantic Analysis Limitedbin/beast-agent.js

HighKnown Malware Source Similaritysrc/agent/bus.js

Affected versions and remediation

This report applies to beast-agent@2.11.0.

See all versions of beast-agent for other recorded verdicts.

Review the evidence and your use of beast-agent@2.11.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-07 16:53:34.520Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code