registry / Install hook abuse / beast-agent / 2.36.0

beast-agent@2.36.0

Ultra-fast local agent shell for Windows.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The source contains risky automatic installation and broadly empowered agent functionality, but it does not meet the policy threshold for malicious intent or a publish block. Warn so the lifecycle downloader and remote content paths receive additional scrutiny.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the npm package activates the repair hook; using agent Python or the skills-store install action activates the runtime paths.

Impact

A compromised mirror, skills feed, or agent interaction could introduce unreviewed code or make broad local changes.

Mechanism

Automatic dependency repair plus agent-controlled download, file write, and command execution.

AI rationale

Evidence

package.jsonscripts/fix-electron.jssrc/agent/tools.jssrc/agent/store.jssrc/agent/engine.jsnode_modules/electron/distnode_modules/electron/path.txtnode_modules/electron/install.js%APPDATA%\beast\py%APPDATA%\beast\skills\<id>

Network endpoints4

npmmirror.com/mirrors/electron/www.python.org/ftp/python/3.12.8/python-3.12.8-embed-amd64.zipbeastagent-skills.web.appraw.githubusercontent.com/algokodcom/beast-agent/main/store/skills.json

Decision evidence

public snapshot

AI called this Suspicious at 85.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The postinstall hook automatically runs a repair script.
That repair deletes Electron files and runs Electron's installer, with a third-party mirror fallback.
The runtime agent can download and unpack a Python distribution before running user or model-supplied Python.
The skills store fetches remote skill content and writes it into the application's active skills directory.
Agent commands are broadly auto-approved except for deletion operations.

Evidence against

There is no runtime dependency on beast-agent itself, so no nested lifecycle chain is present.
The install hook is a transparent Electron repair path and does not modify AI-agent configuration or unrelated project files.
No source evidence shows credential harvesting, secret exfiltration, stealth persistence, or a hidden remote payload.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork

Source & flagged code

18 flagged

package.jsonView file

Lines 25-65json

25 ],

26 "main": "src/main.js",

27 "preferGlobal": true,

28 "bin": {

29 "beast-agent": "bin/beast-agent.js",

30 "beast": "bin/beast-agent.js"

31 },

32 "files": [

33 "src/**/*",

34 "assets/**/*",

35 "scripts/**/*",

36 "!**/__pycache__/**"

37 ],

38 "scripts": {

39 "start": "electron .",

40 "dist": "electron-builder --win nsis portable",

41 "test": "node --test \"tests/**/*.test.js\"",

42 "release": "node scripts/release.js",

43 "skillsweb:sync": "node skillsweb/sync-builtins.js",

44 "skillsweb:deploy": "node skillsweb/sync-builtins.js && cd skillsweb && firebase deploy --only hosting:skills",

45 "postinstall": "node scripts/fix-electron.js --soft",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "prepublishOnly": "node scripts/swap-electron.js deps",

47 "postpublish": "node scripts/swap-electron.js devdeps"

48 },

49 "devDependencies": {

50 "electron-builder": "^26.15.3"

51 },

52 "dependencies": {

53 "@huggingface/transformers": "3.7.5",

54 "@pdf-lib/fontkit": "^1.1.1",

55 "@whiskeysockets/baileys": "^7.0.0-rc14",

56 "@xenova/transformers": "^2.17.2",

57 "electron-updater": "^6.8.9",

58 "ffmpeg-static": "^5.3.0",

59 "imapflow": "^1.7.6",

60 "nodemailer": "^9.0.5",

61 "pdf-lib": "^1.17.1",

62 "pdf-parse": "^2.4.5",

63 "pdf-to-img": "^6.3.0",

64 "pdfjs-dist": "^5.6.205",

65 "pdfkit": "^0.20.1",

bin/beast-agent.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

4/* Beast Agent global npm başlatıcısı (`beast` kısa adı da aynı scripte bağlı):

5 `beast` / `beast-agent` → uygulamayı detached başlatır, terminali hemen serbest bırakır

6 `beast update` → npm'den en son sürümü yükler (uygulama kapalıyken çalıştır) */

8const { spawn, spawnSync } = require(

src/main.jsView file

Lines 1-25javascript

1'use strict';

3const { app, BrowserWindow, WebContentsView, ipcMain, shell, dialog, Tray, Menu, nativeImage, desktopCapturer, session,

src/agent/mem0.jsView file

Lines 9-49javascript

9 - Hibrit arama: 0.65*semantic(cosine) + 0.35*keyword (mem0 semantic+BM25 felsefesi)

10 Her fonksiyon degradasyonlu: embedding yoksa keyword, LLM yoksa hash+cos dedup.

src/agent/searxng.jsView file

Lines 1-35javascript

1'use strict';

3/* SearXNG — yerel metasearch entegrasyonu (github.com/searxng/searxng)

4 SearXNG resmi olarak Linux/Docker hedefler; Windows'ta `import pwd`

5 yüzünden patlar. Bu modül Beast'ın GÖMÜLÜ Python'ına gerçek searxng'yi

6 (GitHub master) kurar + pwd shim'i yazar + 127.0.0.1:8888'de arka planda

7 çalıştırır. Arama zinciri 'searxng' motorunu yalnız AYAKTAYSA kullanır.

9 CLI: beast searxng → gerekirse kur + başlat

10 beast searxng status → durum

src/agent/store.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = beast-agent@2.35.1 matchedIdentity = npm:YmVhc3QtYWdlbnQ:2.35.1 similarity = 0.969 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/agent/store.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. src/agent/store.js: const SITE_URL = 'https://beastagent-sk[redacted]'; const COMMUNITY_URL = 'https://raw.githubusercontent.com/algokodcom/beast-agent/main/store/skills.json'; const SKIP_DIRS = new Set(['node_modules', '.git', '__pycache__', '.drafts']); fs.writeFileSync(p, JSON.stringify(obj, null, 2)); fs.writeFileSync(target, String(content ?? ''), 'utf8');

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

src/agent/store.jsView on unpkg

src/agent/tools.jsView file

5const path = require('path'); L6: const https = require('https'); L7: const dns = require('dns'); L8: const net = require('net'); L9: const { execFile } = require('child_process'); L10: const { spawn } = require('child_process'); ... L107: ['-NoProfile', '-NoExit', '-Command', '-'], L108: { cwd: cwd || process.cwd(), windowsHide: true, env: envWithPathPrefix() } L109: ); ... L125: proc.stdin.unref && proc.stdin.unref(); L126: proc.stdout.unref && proc.stdout.unref(); L127: proc.stderr.unref && proc.stderr.unref();

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/agent/tools.jsView on unpkg · L5

src/agent/computeruse.jsView file

8L9: Sürücü: https://github.com/trycua/cua — `cua-driver mcp` stdio MCP sunucusu; L10: el yazımı minimal JSON-RPC 2.0 client'ı (mcp.js ile aynı çerçeve). L11: Binary yoksa eski PowerShell backend'ine düşer (yalnız koordinat + foreground). L12: ... L49: otomatik kurulum asla çalışmaz (tests dahil). */ L50: return !String(process.env.BEAST_CUA_DRIVER_CMD || '').trim(); L51: } ... L56: return new Promise((resolve) => { L57: execFile(driverCmd(), ['--version'], { timeout: 10000, windowsHide: true }, (err, stdout) => { L58: const res = { ... L70: function runInstaller(cb) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/agent/computeruse.jsView on unpkg · L8

bin/beast-agent.js#virtual:normalized:round1View file

29L30: /* güncelleme modu: çalışan Beast"i kapat (dosya kilidi EBUSY vermesin) → npm güncelle (görünür ilerleme) → yeniden başlat.\r\n Bu komut güncelleme butonu tarafından GÖRÜNÜR bir ... L31: detached: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/beast-agent.js#virtual:normalized:round1View on unpkg · L29

src/agent/scripts/mt5_bridge.pyView file

•path = src/agent/scripts/mt5_bridge.py kind = build_helper sizeBytes = 14080 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/agent/scripts/mt5_bridge.pyView on unpkg

src/agent/bus.jsView file

•matchType = normalized_sha256 matchedPackage = beast-agent@1.2.3 matchedPath = src/agent/bus.js matchedIdentity = npm:YmVhc3QtYWdlbnQ:1.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent/bus.jsView on unpkg

src/agent/config.jsView file

•matchType = normalized_sha256 matchedPackage = beast-agent@1.2.3 matchedPath = src/agent/config.js matchedIdentity = npm:YmVhc3QtYWdlbnQ:1.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent/config.jsView on unpkg

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-electron.js --soft

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/fix-electron.js --soft

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/beast-agent.jsView file

7L8: const { spawn, spawnSync } = require('child_process'); L9: const path = require('path');

High

Child Process

Package source references child process execution.

bin/beast-agent.jsView on unpkg · L7

Findings

3 Critical11 High6 Medium6 Low

CriticalDownload Executesrc/agent/tools.js

CriticalTrigger Reachable Dangerous Capabilitysrc/main.js

CriticalPrevious Version Dangerous Deltasrc/agent/store.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/beast-agent.js

HighShellsrc/main.js

HighSame File Env Network Executionsrc/agent/searxng.js

HighEntrypoint Foreign Package Code Overwritesrc/agent/store.js

HighCommand Output Exfiltrationsrc/main.js

HighSandbox Evasion Gated Capabilitysrc/agent/computeruse.js

HighRuntime Package Installbin/beast-agent.js#virtual:normalized:round1

Affected versions and remediation

This report applies to beast-agent@2.36.0.

See all versions of beast-agent for other recorded verdicts.

Review the evidence and your use of beast-agent@2.36.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 14:12:59.183Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code