wechat-bro@1.1.0
AI agent interface for WeChat Web — send/receive messages, manage contacts, upload media, transcribe voice
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source contains a real unauthenticated automation service and install-time browser download, so it warrants a warning. The observed behavior is package-aligned and does not provide concrete evidence of malicious intent.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Package installation for the browser download, or explicit daemon execution for the WebSocket service.
Impact
A reachable client could access the authenticated WeChat automation service; the source does not establish an attacker-controlled listener exposure or exfiltration chain.
Mechanism
A postinstall browser download and unauthenticated WebSocket command dispatch.
AI rationale
The source contains a real unauthenticated automation service and install-time browser download, so it warrants a warning. The observed behavior is package-aligned and does not provide concrete evidence of malicious intent.
Evidence
package.jsonsrc/cli.jssrc/ws-server.jssrc/upload.jssrc/transcribe.jssrc/wechat-bro.js~/.wechat-bro/chromium~/.wechat-bro/cookies.json~/.wechat-bro/messages.jsonl~/.wechat-bro/download
Network endpoints2
wx.qq.comws://localhost:9231
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The postinstall hook can invoke npx to download Chrome during dependency installation.
- The daemon opens a WebSocket server without authentication before dispatching messaging commands.
- The daemon stores WeChat session cookies and message data in its own data directory.
Evidence against
- The install hook only prepares a Puppeteer browser cache under the package's own data directory.
- Source behavior is aligned with a WeChat automation client and uses wx.qq.com.
- No source evidence shows credential exfiltration to an unrelated endpoint, remote payload execution, or AI-agent configuration changes.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = node -e "const p=require('path'),o=require('os'),d=p.join(o.homedir(),'.wechat-bro','chromium');process.env.PUPPETEER_CACHE_DIR=d;const pup=require('puppeteer');(async()=>{try{awai...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "const p=require('path'),o=require('os'),d=p.join(o.homedir(),'.wechat-bro','chromium');process.env.PUPPETEER_CACHE_DIR=d;const pup=require('puppeteer');(async()=>{try{awai...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgsrc/upload.jsView file
9L10: const { execFileSync } = require('child_process')
L11: const fs = require('fs')
High
Child Process
Package source references child process execution.
Findings
2 Critical4 High3 Medium4 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalPrevious Version Dangerous Deltasrc/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processsrc/upload.js
HighSame File Env Network Executionsrc/cli.js
HighRuntime Package Installsrc/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to wechat-bro@1.1.0.
See all versions of wechat-bro for other recorded verdicts.
- Review the evidence and your use of wechat-bro@1.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.