wechat-bro@1.6.14
AI agent interface for WeChat Web — send/receive messages, manage contacts, upload media, transcribe voice
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe postinstall hook installs the browser required by Puppeteer, while runtime account and media actions are part of the package’s stated WeChat interface. The reviewed credential use is tied to WeChat uploads, and no unrelated collection or unrequested account action was found.
Decision evidence
public snapshot- The postinstall hook checks for Chromium and, if absent, installs Chrome through Puppeteer’s browser installer into ~/.wechat-bro/chromium.
- CLI commands and piped input connect to an already running daemon; the user starts daemon mode explicitly.
- Media upload uses the active WeChat session’s cookies and authentication fields for the upload flow.
- Sending an image requires an explicit recipient and local file path.
- The orchestrator dispatches messages for watched contacts to configured agents; its shell harness runs as part of that dispatch.
- Installation runs a postinstall script that may download a browser.
- The package uses child processes and handles WeChat session cookies for its intended messaging and media-upload functions.
Source & flagged code
5 flaggedInstall-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to wechat-bro@1.6.14.
See all versions of wechat-bro for other recorded verdicts.
- Review the evidence and your use of wechat-bro@1.6.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.