wechat-bro@1.6.16
AI agent interface for WeChat Web — send/receive messages, manage contacts, upload media, transcribe voice
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe manifest's postinstall hook sets up Chromium in the package data directory. Separately, runtime orchestration can replace AGENTS.md in its selected working directory, a package-owned agent configuration capability that warrants a warning but does not establish a concrete attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A message or scheduled task is dispatched to an orchestrator agent.
Impact
A pre-existing AGENTS.md in that working directory may be removed and agent instructions may be replaced.
Mechanism
The orchestrator refreshes AGENTS.md by removing the existing destination and creating a symlink or copy to the selected agent file.
AI rationale
The manifest's postinstall hook sets up Chromium in the package data directory. Separately, runtime orchestration can replace AGENTS.md in its selected working directory, a package-owned agent configuration capability that warrants a warning but does not establish a concrete attack.
Evidence
src/orchestrator.jsAGENTS.md
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The postinstall hook checks for Chromium and installs it under ~/.wechat-bro/chromium if absent.
- During orchestrator dispatch, the package uses a configured contact-agent working directory and refreshes its AGENTS.md before launching the harness.
- Refreshing AGENTS.md removes an existing destination and replaces it with a symlink or copy of the package-selected agent file.
- Media upload obtains WeChat upload parameters and sends the supplied file using WeChat session cookies to the returned upload URL.
Evidence against
- The install hook is scoped to setting up the browser dependency in the package's data directory.
- The agent configuration write occurs as part of runtime orchestrator dispatch, not an npm install hook.
- The inspected upload path sends media to the upload URL returned by WeChat's page context.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = node -e "const p=require('path'),o=require('os'),d=p.join(o.homedir(),'.wechat-bro','chromium');process.env.PUPPETEER_CACHE_DIR=d;const pup=require('puppeteer');(async()=>{try{awai...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "const p=require('path'),o=require('os'),d=p.join(o.homedir(),'.wechat-bro','chromium');process.env.PUPPETEER_CACHE_DIR=d;const pup=require('puppeteer');(async()=>{try{awai...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgsrc/upload.jsView file
10L11: const { execFileSync } = require('child_process')
L12: const fs = require('fs')
High
Child Process
Package source references child process execution.
Findings
1 Critical5 High3 Medium4 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processsrc/upload.js
HighShellsrc/cli.js
HighRuntime Package Installsrc/cli.js
HighSemantic Analysis Limitedsrc/upload.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to wechat-bro@1.6.16.
See all versions of wechat-bro for other recorded verdicts.
- Review the evidence and your use of wechat-bro@1.6.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.