registry / AI-agent capability abuse / beast-agent / 2.13.0

beast-agent@2.13.0

Ultra-fast local agent shell for Windows.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is a high-risk AI-agent package with automatic install-time mutation and model-accessible command execution. The source does not establish the concrete malicious lifecycle chain required for a publication block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Npm installation triggers the repair hook; an agent request that uses command or Python tools activates runtime capabilities.

Impact

A compromised, misconfigured, or prompt-injected model could run commands in the configured workspace and install executable tooling.

Mechanism

Automatic dependency repair plus model-directed command execution and runtime download.

AI rationale

Evidence

package.jsonscripts/fix-electron.jssrc/agent/tools.jsnode_modules/electron/distnode_modules/electron/path.txt%APPDATA%\beast\py%TMP%\beast-py-embed.zip

Network endpoints2

npmmirror.comwww.python.org

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Npm installation automatically invokes an Electron repair script.
The repair script removes the Electron runtime directory and runs its install script, with a mirror fallback.
The agent exposes arbitrary PowerShell or Bash execution to its model runtime.
The agent can download and unpack an embedded Python runtime before executing Python.

Evidence against

The install hook is limited to repairing the package's Electron dependency and exits softly.
No self-dependency, credential theft, or covert exfiltration path was confirmed in the inspected code.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

19 flagged

package.jsonView file

Lines 23-63json

23 "llm",

24 "openai"

25 ],

26 "main": "src/main.js",

27 "preferGlobal": true,

28 "bin": {

29 "beast-agent": "bin/beast-agent.js",

30 "beast": "bin/beast-agent.js"

31 },

32 "files": [

33 "src/**/*",

34 "assets/**/*",

35 "scripts/**/*",

36 "!**/__pycache__/**"

37 ],

38 "scripts": {

39 "start": "electron .",

40 "dist": "electron-builder --win nsis portable",

41 "test": "node --test \"tests/**/*.test.js\"",

42 "release": "node scripts/release.js",

43 "postinstall": "node scripts/fix-electron.js --soft",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "prepublishOnly": "node scripts/swap-electron.js deps",

45 "postpublish": "node scripts/swap-electron.js devdeps"

46 },

47 "devDependencies": {

48 "electron-builder": "^26.15.3"

49 },

50 "dependencies": {

51 "@huggingface/transformers": "3.7.5",

52 "@pdf-lib/fontkit": "^1.1.1",

53 "@whiskeysockets/baileys": "^7.0.0-rc14",

54 "@xenova/transformers": "^2.17.2",

55 "electron-updater": "^6.8.9",

56 "ffmpeg-static": "^5.3.0",

57 "imapflow": "^1.7.6",

58 "nodemailer": "^9.0.5",

59 "pdf-lib": "^1.17.1",

60 "pdf-parse": "^2.4.5",

61 "pdf-to-img": "^6.3.0",

62 "pdfjs-dist": "^5.6.205",

63 "pdfkit": "^0.20.1",

bin/beast-agent.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

4/* Beast Agent global npm başlatıcısı (`beast` kısa adı da aynı scripte bağlı):

5 `beast` / `beast-agent` → uygulamayı detached başlatır, terminali hemen serbest bırakır

6 `beast update` → npm'den en son sürümü yükler (uygulama kapalıyken çalıştır) */

8const { spawn, spawnSync } = require(

src/main.jsView file

Lines 1-25javascript

1'use strict';

3const { app, BrowserWindow, WebContentsView, ipcMain, shell, dialog, Tray, Menu, nativeImage, desktopCapturer, session,

src/agent/mem0.jsView file

Lines 9-49javascript

9 - Hibrit arama: 0.65*semantic(cosine) + 0.35*keyword (mem0 semantic+BM25 felsefesi)

10 Her fonksiyon degradasyonlu: embedding yoksa keyword, LLM yoksa hash+cos dedup.

src/agent/searxng.jsView file

Lines 1-35javascript

1'use strict';

3/* SearXNG — yerel metasearch entegrasyonu (github.com/searxng/searxng)

4 SearXNG resmi olarak Linux/Docker hedefler; Windows'ta `import pwd`

5 yüzünden patlar. Bu modül Beast'ın GÖMÜLÜ Python'ına gerçek searxng'yi

6 (GitHub master) kurar + pwd shim'i yazar + 127.0.0.1:8888'de arka planda

7 çalıştırır. Arama zinciri 'searxng' motorunu yalnız AYAKTAYSA kullanır.

9 CLI: beast searxng → gerekirse kur + başlat

10 beast searxng status → durum

src/agent/store.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. src/agent/store.js: const COMMUNITY_URL = 'https://raw.githubusercontent.com/algokodcom/beast-agent/main/store/skills.json'; const SKIP_DIRS = new Set(['node_modules', '.git', '__pycache__', '.drafts']); fs.writeFileSync(p, JSON.stringify(obj, null, 2)); fs.writeFileSync(target, String(content ?? ''), 'utf8');

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

src/agent/store.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = beast-agent@1.2.3 matchedPath = src/agent/store.js matchedIdentity = npm:YmVhc3QtYWdlbnQ:1.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent/store.jsView on unpkg

src/agent/tools.jsView file

5const path = require('path'); L6: const https = require('https'); L7: const { execFile } = require('child_process'); L8: const { spawn } = require('child_process'); ... L103: ['-NoProfile', '-NoExit', '-Command', '-'], L104: { cwd: cwd || process.cwd(), windowsHide: true, env: envWithPathPrefix() } L105: ); ... L121: proc.stdin.unref && proc.stdin.unref(); L122: proc.stdout.unref && proc.stdout.unref(); L123: proc.stderr.unref && proc.stderr.unref(); ... L193: native exe hata verirse gerçek kod işaret satırına yazılır */ L194: sess.proc.stdin.write(`$global:LASTEXITCODE = 0\n${cmd}${cmd.endsWith('\n') ? '' : '\n'}Write-Output "${marker}"\n`);

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/agent/tools.jsView on unpkg · L5

src/agent/computeruse.jsView file

8L9: Sürücü: https://github.com/trycua/cua — `cua-driver mcp` stdio MCP sunucusu; L10: el yazımı minimal JSON-RPC 2.0 client'ı (mcp.js ile aynı çerçeve). L11: Binary yoksa eski PowerShell backend'ine düşer (yalnız koordinat + foreground). L12: ... L49: otomatik kurulum asla çalışmaz (tests dahil). */ L50: return !String(process.env.BEAST_CUA_DRIVER_CMD || '').trim(); L51: } ... L56: return new Promise((resolve) => { L57: execFile(driverCmd(), ['--version'], { timeout: 10000, windowsHide: true }, (err, stdout) => { L58: const res = { ... L70: function runInstaller(cb) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/agent/computeruse.jsView on unpkg · L8

bin/beast-agent.js#virtual:normalized:round1View file

29L30: /* güncelleme modu: çalışan Beast"i kapat (dosya kilidi EBUSY vermesin) → npm güncelle (görünür ilerleme) → yeniden başlat.\r\n Bu komut güncelleme butonu tarafından GÖRÜNÜR bir ... L31: detached: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/beast-agent.js#virtual:normalized:round1View on unpkg · L29

src/agent/scripts/websearch.pyView file

•path = src/agent/scripts/websearch.py kind = build_helper sizeBytes = 7808 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/agent/scripts/websearch.pyView on unpkg

src/agent/bus.jsView file

•matchType = normalized_sha256 matchedPackage = beast-agent@1.2.3 matchedPath = src/agent/bus.js matchedIdentity = npm:YmVhc3QtYWdlbnQ:1.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent/bus.jsView on unpkg

src/agent/config.jsView file

•matchType = normalized_sha256 matchedPackage = beast-agent@1.2.3 matchedPath = src/agent/config.js matchedIdentity = npm:YmVhc3QtYWdlbnQ:1.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent/config.jsView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-electron.js --soft

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/fix-electron.js --soft

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/beast-agent.jsView file

7L8: const { spawn, spawnSync } = require('child_process'); L9: const path = require('path');

High

Child Process

Package source references child process execution.

bin/beast-agent.jsView on unpkg · L7

Findings

3 Critical12 High6 Medium6 Low

CriticalDownload Executesrc/agent/tools.js

CriticalTrigger Reachable Dangerous Capabilitysrc/main.js

CriticalPrevious Version Dangerous Deltasrc/main.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/beast-agent.js

HighShellsrc/main.js

HighSame File Env Network Executionsrc/agent/searxng.js

HighEntrypoint Foreign Package Code Overwritesrc/agent/store.js

HighCommand Output Exfiltrationsrc/main.js

HighSandbox Evasion Gated Capabilitysrc/agent/computeruse.js

HighRuntime Package Installbin/beast-agent.js#virtual:normalized:round1

Affected versions and remediation

This report applies to beast-agent@2.13.0.

See all versions of beast-agent for other recorded verdicts.

Review the evidence and your use of beast-agent@2.13.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-07 18:01:04.473Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code