registry / AI-agent capability abuse / beast-agent / 2.2.1

beast-agent@2.2.1

Ultra-fast local agent shell for Windows.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is a dangerous-capability package with install-time dependency mutation and permissive runtime agent tools, but the inspected source does not prove concrete malicious behavior. Warn rather than block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation activates the Electron repair hook; launching and using the configured AI agent activates its tools.

Impact

A compromised prompt, connected bot, or model response could run commands or modify files in the configured workspace; the install hook also downloads Electron through its installer.

Mechanism

install-time Electron repair plus unrestricted AI-agent command and file tools

AI rationale

Evidence

package.jsonscripts/fix-electron.jssrc/main.jssrc/agent/engine.jssrc/agent/tools.jssrc/agent/watchers.jsnode_modules/electron/distnode_modules/electron/path.txt

Network endpoints1

npmmirror.com/mirrors/electron/

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The install hook deletes Electron runtime files and invokes Electron's installer, including a third-party mirror fallback.
The AI agent exposes command execution, file writes, and Python execution while its approval gate is disabled by default.
Command execution launches PowerShell with execution-policy bypass.
File writes accept normalized absolute paths without a workspace-boundary check.
The application can persist web watchers that fetch configured URLs periodically.

Evidence against

No runtime dependency on beast-agent itself is declared.
The install hook targets the bundled Electron dependency rather than an AI-agent configuration surface.
No code inspected sends harvested environment variables, credentials, or local files to an attacker-controlled endpoint.
Remote watcher URLs and command tools are application capabilities, not automatic install-time actions.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem

Source & flagged code

19 flagged

package.jsonView file

Lines 23-63json

23 "llm",

24 "openai"

25 ],

26 "main": "src/main.js",

27 "preferGlobal": true,

28 "bin": {

29 "beast-agent": "bin/beast-agent.js",

30 "beast": "bin/beast-agent.js"

31 },

32 "files": [

33 "src/**/*",

34 "assets/**/*",

35 "scripts/**/*",

36 "!**/__pycache__/**"

37 ],

38 "scripts": {

39 "start": "electron .",

40 "dist": "electron-builder --win nsis portable",

41 "test": "node --test \"tests/**/*.test.js\"",

42 "release": "node scripts/release.js",

43 "postinstall": "node scripts/fix-electron.js --soft",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "prepublishOnly": "node scripts/swap-electron.js deps",

45 "postpublish": "node scripts/swap-electron.js devdeps"

46 },

47 "devDependencies": {

48 "electron-builder": "^26.15.3"

49 },

50 "dependencies": {

51 "@pdf-lib/fontkit": "^1.1.1",

52 "@whiskeysockets/baileys": "^7.0.0-rc14",

53 "@xenova/transformers": "^2.17.2",

54 "electron-updater": "^6.8.9",

55 "ffmpeg-static": "^5.3.0",

56 "imapflow": "^1.7.6",

57 "nodemailer": "^9.0.5",

58 "pdf-lib": "^1.17.1",

59 "pdf-parse": "^2.4.5",

60 "pdf-to-img": "^6.3.0",

61 "pdfjs-dist": "^5.6.205",

62 "pdfkit": "^0.20.1",

63 "qrcode": "^1.5.4",

bin/beast-agent.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

4/* Beast Agent global npm başlatıcısı (`beast` kısa adı da aynı scripte bağlı):

5 `beast` / `beast-agent` → uygulamayı detached başlatır, terminali hemen serbest bırakır

6 `beast update` → npm'den en son sürümü yükler (uygulama kapalıyken çalıştır) */

8const { spawn, spawnSync } = require(

src/agent/mem0.jsView file

Lines 9-49javascript

9 - Hibrit arama: 0.65*semantic(cosine) + 0.35*keyword (mem0 semantic+BM25 felsefesi)

10 Her fonksiyon degradasyonlu: embedding yoksa keyword, LLM yoksa hash+cos dedup.

src/agent/searxng.jsView file

Lines 1-35javascript

1'use strict';

3/* SearXNG — yerel metasearch entegrasyonu (github.com/searxng/searxng)

4 SearXNG resmi olarak Linux/Docker hedefler; Windows'ta `import pwd`

5 yüzünden patlar. Bu modül Beast'ın GÖMÜLÜ Python'ına gerçek searxng'yi

6 (GitHub master) kurar + pwd shim'i yazar + 127.0.0.1:8888'de arka planda

7 çalıştırır. Arama zinciri 'searxng' motorunu yalnız AYAKTAYSA kullanır.

9 CLI: beast searxng → gerekirse kur + başlat

10 beast searxng status → durum

src/agent/store.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. src/agent/store.js: const COMMUNITY_URL = 'https://raw.githubusercontent.com/algokodcom/beast-agent/main/store/skills.json'; const SKIP_DIRS = new Set(['node_modules', '.git', '__pycache__', '.drafts']); fs.writeFileSync(p, JSON.stringify(obj, null, 2)); fs.writeFileSync(target, String(content ?? ''), 'utf8');

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

src/agent/store.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = beast-agent@1.2.3 matchedPath = src/agent/store.js matchedIdentity = npm:YmVhc3QtYWdlbnQ:1.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent/store.jsView on unpkg

src/main.jsView file

Lines 1-25javascript

1'use strict';

3const { app, BrowserWindow, WebContentsView, ipcMain, shell, dialog, Tray, Menu, nativeImage, desktopCapturer, session,

src/agent/tools.jsView file

Lines 1-25javascript

1'use strict';

3const fs = require('fs');

4const os = require('os');

5const

bin/beast-agent.js#virtual:normalized:round1View file

29L30: /* güncelleme modu: çalışan Beast"i kapat (dosya kilidi EBUSY vermesin) → npm güncelle (görünür ilerleme) → yeniden başlat.\r\n Bu komut güncelleme butonu tarafından GÖRÜNÜR bir ... L31: detached: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/beast-agent.js#virtual:normalized:round1View on unpkg · L29

src/agent/scripts/websearch.pyView file

•path = src/agent/scripts/websearch.py kind = build_helper sizeBytes = 7808 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/agent/scripts/websearch.pyView on unpkg

src/agent/watchers.jsView file

•matchType = normalized_sha256 matchedPackage = beast-agent@1.2.3 matchedPath = src/agent/watchers.js matchedIdentity = npm:YmVhc3QtYWdlbnQ:1.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent/watchers.jsView on unpkg

src/agent/bus.jsView file

•matchType = normalized_sha256 matchedPackage = beast-agent@1.2.3 matchedPath = src/agent/bus.js matchedIdentity = npm:YmVhc3QtYWdlbnQ:1.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent/bus.jsView on unpkg

src/agent/config.jsView file

•matchType = normalized_sha256 matchedPackage = beast-agent@1.2.3 matchedPath = src/agent/config.js matchedIdentity = npm:YmVhc3QtYWdlbnQ:1.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent/config.jsView on unpkg

src/agent/logger.jsView file

•matchType = normalized_sha256 matchedPackage = beast-agent@1.2.3 matchedPath = src/agent/logger.js matchedIdentity = npm:YmVhc3QtYWdlbnQ:1.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent/logger.jsView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-electron.js --soft

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/fix-electron.js --soft

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/beast-agent.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = beast-agent@1.2.2 matchedIdentity = npm:YmVhc3QtYWdlbnQ:1.2.2 similarity = 0.559 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/beast-agent.js

Findings

3 Critical12 High6 Medium6 Low

CriticalDownload Executesrc/agent/tools.js

CriticalTrigger Reachable Dangerous Capabilitysrc/main.js

CriticalPrevious Version Dangerous Deltabin/beast-agent.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/beast-agent.js

HighSame File Env Network Executionsrc/agent/searxng.js

HighEntrypoint Foreign Package Code Overwritesrc/agent/store.js

HighCommand Output Exfiltrationsrc/main.js

HighRuntime Package Installbin/beast-agent.js#virtual:normalized:round1

HighSemantic Analysis Limitedbin/beast-agent.js

HighKnown Malware Source Similaritysrc/agent/watchers.js

Affected versions and remediation

This report applies to beast-agent@2.2.1.

See all versions of beast-agent for other recorded verdicts.

Review the evidence and your use of beast-agent@2.2.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-03 23:13:45.926Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code