wechat-bro@1.6.12
AI agent interface for WeChat Web — send/receive messages, manage contacts, upload media, transcribe voice
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe daemon sends a message to a publisher-chosen recipient automatically when it becomes ready. That is an unrequested account action, so this version should be blocked.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The daemon reaches its ready state with a logged-in WeChat session.
Impact
Uses the user’s WeChat account to send a message without a separate request to message that recipient.
Mechanism
Startup calls sendText with five check marks and `filehelper`; sendText invokes WeChat’s send function.
Attack narrative
After the daemon becomes ready, it sends five check marks to the fixed WeChat `filehelper` recipient through the logged-in account. This account action happens automatically at startup rather than in response to a user send command.
AI rationale
The daemon sends a message to a publisher-chosen recipient automatically when it becomes ready. That is an unrequested account action, so this version should be blocked.
Evidence
src/cli.js
Network endpoints1
wx.qq.com
Decision evidence
public snapshotAI called this Malicious at 84.0% confidence as Malware with low false-positive risk.
Evidence for block
- When the daemon is ready, it automatically calls sendText with the fixed recipient `filehelper` and five check marks.
- sendText passes the recipient and content to WeChat’s `WB.send` function.
Evidence against
- The package describes itself as an AI agent interface for WeChat, and its CLI also provides explicit send commands.
- The postinstall hook installs Puppeteer’s Chrome browser into the package’s data directory.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = node -e "const p=require('path'),o=require('os'),d=p.join(o.homedir(),'.wechat-bro','chromium');process.env.PUPPETEER_CACHE_DIR=d;const pup=require('puppeteer');(async()=>{try{awai...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "const p=require('path'),o=require('os'),d=p.join(o.homedir(),'.wechat-bro','chromium');process.env.PUPPETEER_CACHE_DIR=d;const pup=require('puppeteer');(async()=>{try{awai...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgFindings
2 Critical4 High3 Medium4 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalPrevious Version Dangerous Deltasrc/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processsrc/upload.js
HighRuntime Package Installsrc/cli.js
HighSemantic Analysis Limitedpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to wechat-bro@1.6.12.
See all versions of wechat-bro for other recorded verdicts.
- Avoid installing wechat-bro@1.6.12. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.