registry / Remote code execution / beast-agent / 2.17.0

beast-agent@2.17.0

Ultra-fast local agent shell for Windows.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package has unsafe remote installer behavior reachable through installation and runtime features. The source supports a warning for dangerous capability, but not a malicious-intent block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation triggers the Electron repair; a computer-control action triggers the driver check and possible installer.

Impact

A compromised upstream installer or driver endpoint could execute code with the user's permissions.

Mechanism

Automatic remote installer execution and agent-controlled shell capability.

AI rationale

The package has unsafe remote installer behavior reachable through installation and runtime features. The source supports a warning for dangerous capability, but not a malicious-intent block.

Evidence

package.jsonscripts/fix-electron.jssrc/main.jssrc/agent/computeruse.jssrc/agent/tools.jsnode_modules/electron/distnode_modules/electron/path.txt%APPDATA%\beast\py%APPDATA%\beast\skills/<id>

Network endpoints8

npmmirror.com/mirrors/electron/cua.ai/driver/install.ps1cua.ai/driver/install.shwww.python.org/ftp/python/3.12.8/python-3.12.8-embed-amd64.zipbootstrap.pypa.io/get-pip.pyraw.githubusercontent.com/searxng/searxng/master/requirements.txtgithub.com/searxng/searxng/archive/refs/heads/master.zipraw.githubusercontent.com/algokodcom/beast-agent/main/store/skills.json

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Critical Vulnerability with medium false-positive risk.

Evidence for warning

The install lifecycle automatically invokes an Electron repair script.
That repair deletes Electron files and runs Electron's installer, with a third-party mirror fallback.
A computer-control action is reachable from the main application and can pipe a remote driver installer into a shell.
The agent can download and unpack an embedded Python runtime, and exposes arbitrary PowerShell commands.
The explicit SearXNG setup path downloads bootstrap code and installs remote Python packages.
The skill store fetches a remote index and writes supplied skill files locally.

Evidence against

No runtime dependency on beast-agent itself was found.
The SearXNG and package-update installers require explicit CLI subcommands.
The Electron repair targets its own Electron dependency rather than consumer project files.
The inspected webhook listener binds only to localhost and checks a token.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVars

Source & flagged code

19 flagged

package.jsonView file

Lines 23-63json

23 "llm",

24 "openai"

25 ],

26 "main": "src/main.js",

27 "preferGlobal": true,

28 "bin": {

29 "beast-agent": "bin/beast-agent.js",

30 "beast": "bin/beast-agent.js"

31 },

32 "files": [

33 "src/**/*",

34 "assets/**/*",

35 "scripts/**/*",

36 "!**/__pycache__/**"

37 ],

38 "scripts": {

39 "start": "electron .",

40 "dist": "electron-builder --win nsis portable",

41 "test": "node --test \"tests/**/*.test.js\"",

42 "release": "node scripts/release.js",

43 "postinstall": "node scripts/fix-electron.js --soft",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "prepublishOnly": "node scripts/swap-electron.js deps",

45 "postpublish": "node scripts/swap-electron.js devdeps"

46 },

47 "devDependencies": {

48 "electron-builder": "^26.15.3"

49 },

50 "dependencies": {

51 "@huggingface/transformers": "3.7.5",

52 "@pdf-lib/fontkit": "^1.1.1",

53 "@whiskeysockets/baileys": "^7.0.0-rc14",

54 "@xenova/transformers": "^2.17.2",

55 "electron-updater": "^6.8.9",

56 "ffmpeg-static": "^5.3.0",

57 "imapflow": "^1.7.6",

58 "nodemailer": "^9.0.5",

59 "pdf-lib": "^1.17.1",

60 "pdf-parse": "^2.4.5",

61 "pdf-to-img": "^6.3.0",

62 "pdfjs-dist": "^5.6.205",

63 "pdfkit": "^0.20.1",

bin/beast-agent.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

4/* Beast Agent global npm başlatıcısı (`beast` kısa adı da aynı scripte bağlı):

5 `beast` / `beast-agent` → uygulamayı detached başlatır, terminali hemen serbest bırakır

6 `beast update` → npm'den en son sürümü yükler (uygulama kapalıyken çalıştır) */

8const { spawn, spawnSync } = require(

src/main.jsView file

Lines 1-25javascript

1'use strict';

3const { app, BrowserWindow, WebContentsView, ipcMain, shell, dialog, Tray, Menu, nativeImage, desktopCapturer, session,

src/agent/mem0.jsView file

Lines 9-49javascript

9 - Hibrit arama: 0.65*semantic(cosine) + 0.35*keyword (mem0 semantic+BM25 felsefesi)

10 Her fonksiyon degradasyonlu: embedding yoksa keyword, LLM yoksa hash+cos dedup.

src/agent/searxng.jsView file

Lines 1-35javascript

1'use strict';

3/* SearXNG — yerel metasearch entegrasyonu (github.com/searxng/searxng)

4 SearXNG resmi olarak Linux/Docker hedefler; Windows'ta `import pwd`

5 yüzünden patlar. Bu modül Beast'ın GÖMÜLÜ Python'ına gerçek searxng'yi

6 (GitHub master) kurar + pwd shim'i yazar + 127.0.0.1:8888'de arka planda

7 çalıştırır. Arama zinciri 'searxng' motorunu yalnız AYAKTAYSA kullanır.

9 CLI: beast searxng → gerekirse kur + başlat

10 beast searxng status → durum

src/agent/store.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. src/agent/store.js: const COMMUNITY_URL = 'https://raw.githubusercontent.com/algokodcom/beast-agent/main/store/skills.json'; const SKIP_DIRS = new Set(['node_modules', '.git', '__pycache__', '.drafts']); fs.writeFileSync(p, JSON.stringify(obj, null, 2)); fs.writeFileSync(target, String(content ?? ''), 'utf8');

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

src/agent/store.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = beast-agent@1.2.3 matchedPath = src/agent/store.js matchedIdentity = npm:YmVhc3QtYWdlbnQ:1.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent/store.jsView on unpkg

src/agent/tools.jsView file

5const path = require('path'); L6: const https = require('https'); L7: const { execFile } = require('child_process'); L8: const { spawn } = require('child_process'); ... L105: ['-NoProfile', '-NoExit', '-Command', '-'], L106: { cwd: cwd || process.cwd(), windowsHide: true, env: envWithPathPrefix() } L107: ); ... L123: proc.stdin.unref && proc.stdin.unref(); L124: proc.stdout.unref && proc.stdout.unref(); L125: proc.stderr.unref && proc.stderr.unref(); ... L195: native exe hata verirse gerçek kod işaret satırına yazılır */ L196: sess.proc.stdin.write(`$global:LASTEXITCODE = 0\n${cmd}${cmd.endsWith('\n') ? '' : '\n'}Write-Output "${marker}"\n`);

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/agent/tools.jsView on unpkg · L5

src/agent/computeruse.jsView file

8L9: Sürücü: https://github.com/trycua/cua — `cua-driver mcp` stdio MCP sunucusu; L10: el yazımı minimal JSON-RPC 2.0 client'ı (mcp.js ile aynı çerçeve). L11: Binary yoksa eski PowerShell backend'ine düşer (yalnız koordinat + foreground). L12: ... L49: otomatik kurulum asla çalışmaz (tests dahil). */ L50: return !String(process.env.BEAST_CUA_DRIVER_CMD || '').trim(); L51: } ... L56: return new Promise((resolve) => { L57: execFile(driverCmd(), ['--version'], { timeout: 10000, windowsHide: true }, (err, stdout) => { L58: const res = { ... L70: function runInstaller(cb) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/agent/computeruse.jsView on unpkg · L8

bin/beast-agent.js#virtual:normalized:round1View file

29L30: /* güncelleme modu: çalışan Beast"i kapat (dosya kilidi EBUSY vermesin) → npm güncelle (görünür ilerleme) → yeniden başlat.\r\n Bu komut güncelleme butonu tarafından GÖRÜNÜR bir ... L31: detached: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/beast-agent.js#virtual:normalized:round1View on unpkg · L29

src/agent/scripts/mt5_bridge.pyView file

•path = src/agent/scripts/mt5_bridge.py kind = build_helper sizeBytes = 11336 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/agent/scripts/mt5_bridge.pyView on unpkg

src/agent/bus.jsView file

•matchType = normalized_sha256 matchedPackage = beast-agent@1.2.3 matchedPath = src/agent/bus.js matchedIdentity = npm:YmVhc3QtYWdlbnQ:1.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent/bus.jsView on unpkg

src/agent/config.jsView file

•matchType = normalized_sha256 matchedPackage = beast-agent@1.2.3 matchedPath = src/agent/config.js matchedIdentity = npm:YmVhc3QtYWdlbnQ:1.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent/config.jsView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-electron.js --soft

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/fix-electron.js --soft

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/beast-agent.jsView file

7L8: const { spawn, spawnSync } = require('child_process'); L9: const path = require('path');

High

Child Process

Package source references child process execution.

bin/beast-agent.jsView on unpkg · L7

Findings

3 Critical12 High6 Medium6 Low

CriticalDownload Executesrc/agent/tools.js

CriticalTrigger Reachable Dangerous Capabilitysrc/main.js

CriticalPrevious Version Dangerous Deltasrc/main.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/beast-agent.js

HighShellsrc/main.js

HighSame File Env Network Executionsrc/agent/searxng.js

HighEntrypoint Foreign Package Code Overwritesrc/agent/store.js

HighCommand Output Exfiltrationsrc/main.js

HighSandbox Evasion Gated Capabilitysrc/agent/computeruse.js

HighRuntime Package Installbin/beast-agent.js#virtual:normalized:round1

Affected versions and remediation

This report applies to beast-agent@2.17.0.

See all versions of beast-agent for other recorded verdicts.

Review the evidence and your use of beast-agent@2.17.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-08 16:06:32.153Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code