wechat-bro@1.6.1
AI agent interface for WeChat Web — send/receive messages, manage contacts, upload media, transcribe voice
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has a real high-risk autonomous-agent capability and an automatic external browser install, warranting a warning. Source inspection does not establish concrete malware behavior or the policy conditions for a publish block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Run the orchestrator after configuring or accepting its default agents; package installation triggers browser provisioning.
Impact
Untrusted chat content can reach a full-access local agent, creating prompt-injection-driven local execution risk.
Mechanism
Inbound-message-to-shell AI-agent dispatch and install-time browser download.
AI rationale
The package has a real high-risk autonomous-agent capability and an automatic external browser install, warranting a warning. Source inspection does not establish concrete malware behavior or the policy conditions for a publish block.
Evidence
package.jsonsrc/orchestrator.js~/.wechat-bro/chromium~/.wechat-bro/contacts/<contact>/.task-<timestamp>.md~/.wechat-bro/contacts/<contact>/AGENTS.md
Network endpoints1
wx.qq.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The postinstall hook automatically invokes npx to install Chrome into the user's home directory.
- The optional orchestrator turns inbound WeChat messages into shell-launched AI-agent tasks, including full-access Codex and allow-all Copilot templates.
- The dispatcher writes agent task files and replaces AGENTS.md in each agent working directory before spawning the configured harness.
Evidence against
- The lifecycle hook is limited to Puppeteer browser provisioning; no self-dependency or foreign AI-agent configuration mutation was found.
- Network use is tied to wx.qq.com and WeChat media-upload parameters, consistent with the package's stated messaging function.
- No credential exfiltration endpoint, hidden payload loader, or destructive install-time action was found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.postinstall = node -e "const p=require('path'),o=require('os'),d=p.join(o.homedir(),'.wechat-bro','chromium');process.env.PUPPETEER_CACHE_DIR=d;const pup=require('puppeteer');(async()=>{try{awai...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "const p=require('path'),o=require('os'),d=p.join(o.homedir(),'.wechat-bro','chromium');process.env.PUPPETEER_CACHE_DIR=d;const pup=require('puppeteer');(async()=>{try{awai...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgFindings
2 Critical6 High3 Medium4 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalPrevious Version Dangerous Deltasrc/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processsrc/upload.js
HighSame File Env Network Executionsrc/cli.js
HighRuntime Package Installsrc/cli.js
HighSemantic Analysis Limitedpackage.json
HighKnown Malware Source Similaritypackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to wechat-bro@1.6.1.
See all versions of wechat-bro for other recorded verdicts.
- Review the evidence and your use of wechat-bro@1.6.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.