registry / Remote code execution / beast-agent / 2.35.0

beast-agent@2.35.0

Ultra-fast local agent shell for Windows.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package is a high-privilege desktop agent with unguarded model tool execution and remote runtime bootstrapping. The observed lifecycle behavior is package-aligned rather than a concrete malicious install chain, so a warning is warranted instead of a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Launching the application and invoking the run_command or python_run agent tools; npm installation also triggers the Electron repair hook.

Impact

A malicious prompt or compromised model/provider could cause commands to run with the desktop user's permissions.

Mechanism

Agent-mediated command execution and remote runtime bootstrapping.

AI rationale

Evidence

package.jsonscripts/fix-electron.jssrc/agent/tools.jssrc/main.jsnode_modules/electron/distnode_modules/electron/path.txt%APPDATA%/beast/py%TMP%/beast-py-embed.zip

Network endpoints2

www.python.org/ftp/python/3.12.8/python-3.12.8-embed-amd64.zipnpmmirror.com/mirrors/electron/

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Its install hook can delete Electron files and invoke Electron's installer, including through a mirror.
The agent exposes unrestricted shell command execution to model tool calls.
The Python tool downloads an archive, expands it, and runs supplied Python code.
The package has an automatic updater for packaged builds.

Evidence against

No runtime dependency on beast-agent itself is declared.
The install hook targets this package's Electron dependency rather than an AI-agent control surface.
No source inspected harvested credentials or sent local files to an unrelated endpoint.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

19 flagged

package.jsonView file

Lines 23-63json

23 "llm",

24 "openai"

25 ],

26 "main": "src/main.js",

27 "preferGlobal": true,

28 "bin": {

29 "beast-agent": "bin/beast-agent.js",

30 "beast": "bin/beast-agent.js"

31 },

32 "files": [

33 "src/**/*",

34 "assets/**/*",

35 "scripts/**/*",

36 "!**/__pycache__/**"

37 ],

38 "scripts": {

39 "start": "electron .",

40 "dist": "electron-builder --win nsis portable",

41 "test": "node --test \"tests/**/*.test.js\"",

42 "release": "node scripts/release.js",

43 "postinstall": "node scripts/fix-electron.js --soft",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "prepublishOnly": "node scripts/swap-electron.js deps",

45 "postpublish": "node scripts/swap-electron.js devdeps"

46 },

47 "devDependencies": {

48 "electron-builder": "^26.15.3"

49 },

50 "dependencies": {

51 "@huggingface/transformers": "3.7.5",

52 "@pdf-lib/fontkit": "^1.1.1",

53 "@whiskeysockets/baileys": "^7.0.0-rc14",

54 "@xenova/transformers": "^2.17.2",

55 "electron-updater": "^6.8.9",

56 "ffmpeg-static": "^5.3.0",

57 "imapflow": "^1.7.6",

58 "nodemailer": "^9.0.5",

59 "pdf-lib": "^1.17.1",

60 "pdf-parse": "^2.4.5",

61 "pdf-to-img": "^6.3.0",

62 "pdfjs-dist": "^5.6.205",

63 "pdfkit": "^0.20.1",

bin/beast-agent.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

4/* Beast Agent global npm başlatıcısı (`beast` kısa adı da aynı scripte bağlı):

5 `beast` / `beast-agent` → uygulamayı detached başlatır, terminali hemen serbest bırakır

6 `beast update` → npm'den en son sürümü yükler (uygulama kapalıyken çalıştır) */

8const { spawn, spawnSync } = require(

src/main.jsView file

Lines 1-25javascript

1'use strict';

3const { app, BrowserWindow, WebContentsView, ipcMain, shell, dialog, Tray, Menu, nativeImage, desktopCapturer, session,

src/agent/mem0.jsView file

Lines 9-49javascript

9 - Hibrit arama: 0.65*semantic(cosine) + 0.35*keyword (mem0 semantic+BM25 felsefesi)

10 Her fonksiyon degradasyonlu: embedding yoksa keyword, LLM yoksa hash+cos dedup.

src/agent/searxng.jsView file

Lines 1-35javascript

1'use strict';

3/* SearXNG — yerel metasearch entegrasyonu (github.com/searxng/searxng)

4 SearXNG resmi olarak Linux/Docker hedefler; Windows'ta `import pwd`

5 yüzünden patlar. Bu modül Beast'ın GÖMÜLÜ Python'ına gerçek searxng'yi

6 (GitHub master) kurar + pwd shim'i yazar + 127.0.0.1:8888'de arka planda

7 çalıştırır. Arama zinciri 'searxng' motorunu yalnız AYAKTAYSA kullanır.

9 CLI: beast searxng → gerekirse kur + başlat

10 beast searxng status → durum

src/agent/store.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. src/agent/store.js: const COMMUNITY_URL = 'https://raw.githubusercontent.com/algokodcom/beast-agent/main/store/skills.json'; const SKIP_DIRS = new Set(['node_modules', '.git', '__pycache__', '.drafts']); fs.writeFileSync(p, JSON.stringify(obj, null, 2)); fs.writeFileSync(target, String(content ?? ''), 'utf8');

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

src/agent/store.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = beast-agent@1.2.3 matchedPath = src/agent/store.js matchedIdentity = npm:YmVhc3QtYWdlbnQ:1.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent/store.jsView on unpkg

src/agent/tools.jsView file

5const path = require('path'); L6: const https = require('https'); L7: const dns = require('dns'); L8: const net = require('net'); L9: const { execFile } = require('child_process'); L10: const { spawn } = require('child_process'); ... L107: ['-NoProfile', '-NoExit', '-Command', '-'], L108: { cwd: cwd || process.cwd(), windowsHide: true, env: envWithPathPrefix() } L109: ); ... L125: proc.stdin.unref && proc.stdin.unref(); L126: proc.stdout.unref && proc.stdout.unref(); L127: proc.stderr.unref && proc.stderr.unref();

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/agent/tools.jsView on unpkg · L5

src/agent/computeruse.jsView file

8L9: Sürücü: https://github.com/trycua/cua — `cua-driver mcp` stdio MCP sunucusu; L10: el yazımı minimal JSON-RPC 2.0 client'ı (mcp.js ile aynı çerçeve). L11: Binary yoksa eski PowerShell backend'ine düşer (yalnız koordinat + foreground). L12: ... L49: otomatik kurulum asla çalışmaz (tests dahil). */ L50: return !String(process.env.BEAST_CUA_DRIVER_CMD || '').trim(); L51: } ... L56: return new Promise((resolve) => { L57: execFile(driverCmd(), ['--version'], { timeout: 10000, windowsHide: true }, (err, stdout) => { L58: const res = { ... L70: function runInstaller(cb) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/agent/computeruse.jsView on unpkg · L8

bin/beast-agent.js#virtual:normalized:round1View file

29L30: /* güncelleme modu: çalışan Beast"i kapat (dosya kilidi EBUSY vermesin) → npm güncelle (görünür ilerleme) → yeniden başlat.\r\n Bu komut güncelleme butonu tarafından GÖRÜNÜR bir ... L31: detached: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/beast-agent.js#virtual:normalized:round1View on unpkg · L29

src/agent/scripts/mt5_bridge.pyView file

•path = src/agent/scripts/mt5_bridge.py kind = build_helper sizeBytes = 14080 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/agent/scripts/mt5_bridge.pyView on unpkg

src/agent/bus.jsView file

•matchType = normalized_sha256 matchedPackage = beast-agent@1.2.3 matchedPath = src/agent/bus.js matchedIdentity = npm:YmVhc3QtYWdlbnQ:1.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent/bus.jsView on unpkg

src/agent/config.jsView file

•matchType = normalized_sha256 matchedPackage = beast-agent@1.2.3 matchedPath = src/agent/config.js matchedIdentity = npm:YmVhc3QtYWdlbnQ:1.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent/config.jsView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-electron.js --soft

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/fix-electron.js --soft

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/beast-agent.jsView file

7L8: const { spawn, spawnSync } = require('child_process'); L9: const path = require('path');

High

Child Process

Package source references child process execution.

bin/beast-agent.jsView on unpkg · L7

Findings

3 Critical12 High6 Medium6 Low

CriticalDownload Executesrc/agent/tools.js

CriticalTrigger Reachable Dangerous Capabilitysrc/main.js

CriticalPrevious Version Dangerous Deltasrc/main.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/beast-agent.js

HighShellsrc/main.js

HighSame File Env Network Executionsrc/agent/searxng.js

HighEntrypoint Foreign Package Code Overwritesrc/agent/store.js

HighCommand Output Exfiltrationsrc/main.js

HighSandbox Evasion Gated Capabilitysrc/agent/computeruse.js

HighRuntime Package Installbin/beast-agent.js#virtual:normalized:round1

Affected versions and remediation

This report applies to beast-agent@2.35.0.

See all versions of beast-agent for other recorded verdicts.

Review the evidence and your use of beast-agent@2.35.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 03:33:16.827Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code