registry / wechat-bro / 1.6.17
wechat-bro@1.6.17
AI agent interface for WeChat Web — send/receive messages, manage contacts, upload media, transcribe voice
AI Security Review
scanned 13d ago · by lpm-firewall-aiSource inspection resolved the install hook as Chrome provisioning for the Puppeteer-based WeChat client, and the flagged runtime and dependency behavior did not establish a concrete attack surface. The orchestrator’s AGENTS.md write occurs during an orchestrator task in its task directory, while the flagged service setup is an explicit command.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Package installation triggers browser setup; later browser, media, or orchestrator actions require running the package or its service command.
Impact
The inspected behavior supports the package’s stated WeChat client function; no unrelated credential transfer, destructive action, or unconsented agent control change was identified.
Mechanism
The hook checks for Puppeteer’s browser executable and installs Chrome into the package’s cache when absent. Runtime code launches Chrome for WeChat Web, uploads selected media to WeChat, and writes the configured agent file into an orchestrator task directory.
AI rationale
Source inspection resolved the install hook as Chrome provisioning for the Puppeteer-based WeChat client, and the flagged runtime and dependency behavior did not establish a concrete attack surface. The orchestrator’s AGENTS.md write occurs during an orchestrator task in its task directory, while the flagged service setup is an explicit command.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json’s postinstall checks Puppeteer’s browser path and, if unavailable, installs Chrome into the package’s own cache directory.
- The package uses Puppeteer to launch Chrome for WeChat Web; its upload helper sends caller-selected media to WeChat’s file service using the active session.
- The orchestrator creates a per-task directory and places its configured agent file there as AGENTS.md when the orchestrator runs.
- The inspected Puppeteer install hook downloads a supported browser; its entrypoint calls Puppeteer’s installer.
- The inspected qrcode-terminal and ws manifests show no install lifecycle hooks; their entrypoints expose library functionality.
- The inspected ws browser entrypoint explicitly throws because ws is not for browser use.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = node -e "const p=require('path'),o=require('os'),d=p.join(o.homedir(),'.wechat-bro','chromium');process.env.PUPPETEER_CACHE_DIR=d;const pup=require('puppeteer');(async()=>{try{awai...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "const p=require('path'),o=require('os'),d=p.join(o.homedir(),'.wechat-bro','chromium');process.env.PUPPETEER_CACHE_DIR=d;const pup=require('puppeteer');(async()=>{try{awai...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgskills/wechat-bro/bin/services.mjsView file
1#!/usr/bin/env node
L2: import {spawnSync} from 'node:child_process';
L3: const skill="wechat-bro";
High
Findings
1 Critical5 High3 Medium4 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processskills/wechat-bro/bin/services.mjs
HighShellsrc/cli.js
HighRuntime Package Installsrc/cli.js
HighSemantic Analysis Limitedsrc/upload.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to wechat-bro@1.6.17.
See all versions of wechat-bro for other recorded verdicts.
- Review the evidence and your use of wechat-bro@1.6.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.