MAL-2026-10723

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@yeaft/webchat-agent/MAL-2026-10723.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10723
Published
2026-07-16T18:44:35Z
Modified
2026-07-16T19:19:39.546762408Z
Summary
Malicious code in @yeaft/webchat-agent (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f9c505d42f1b2b4f64592abbf753ebf4b8eb5e11d359bc4fb8b8a9a9db3ec36e)

On startup the agent opens a WebSocket to a configurable server (SERVER_URL / config.serverUrl, default ws://localhost:3456) and dispatches server-originated messages to handlers on the installer's host. handleTerminalCreate spawns the user's login shell via node-pty (pty.spawn(shell,...)) and handleTerminalInput writes bytes from the WebSocket directly into that PTY (term.pty.write(msg.data)), giving whoever controls the endpoint an interactive shell on the host. The same router exposes read_file, write_file, delete_files, git_push, and upgrade_agent operations, and installs a persistent systemd/launchd/pm2 service via service/*.js so the channel is re-established across reboots. The upgrade_agent message writes a detached bash/VBScript that runs npm install @yeaft/webchat-agent@latest and restarts the service, letting the remote party force a reinstall and restart on demand. Because serverUrl can be pointed at any host, an installer that connects to (or is MITM'd onto) a hostile endpoint exposes full-host remote code execution and persistence. A separate startup path git-clones https://github.com/yeaft/yeaft-skills.git (unpinned default-branch HEAD) into ~/.claude/plugins/marketplaces/yeaft-skills-dev and enables it in ~/.claude/settings.json, silently registering a mutable-HEAD plugin into Claude Code's plugin system on every run.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-16T18:54:03.615644006Z",
            "source": "amazon-inspector",
            "sha256": "f9c505d42f1b2b4f64592abbf753ebf4b8eb5e11d359bc4fb8b8a9a9db3ec36e",
            "versions": [
                "1.0.171"
            ],
            "id": "IN-MAL-2026-010767",
            "modified_time": "2026-07-16T18:44:35Z"
        }
    ]
}
References
Credits

Affected packages

npm / @yeaft/webchat-agent

Package

Name
@yeaft/webchat-agent
View open source insights on deps.dev
Purl
pkg:npm/%40yeaft/webchat-agent

Affected ranges

Affected versions

1.*
1.0.171

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "4ae1316a4dfa033541b3603a565b2541b36290373b85fd88bfec4722afd627c9292bd4",
            "sha256": "01abdefb250f09f4038d02e7614e1c92ba236ae4925be577c15ea60e89462fab",
            "path": "terminal.js"
        },
        {
            "tlsh": "59b2096833b301351a75126adb2f90127b2fc19b2a04f590b5fe46d82fde11d417bafa",
            "sha256": "ed09ea3d3b4207de5197bb71ff1925dbb000737f3b0789aaa95c8c47bebb98db",
            "path": "connection/upgrade.js"
        },
        {
            "tlsh": "e552b54a09ba46344e6223bda71f10237262e6473304f970b7ad07597f8a42c86b37df",
            "sha256": "a5c51d033e022f99902c33dfe0356d0f09b906e06ef4be924c7e0c6390e90741",
            "path": "index.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "webchat-agent-1.0.171.tgz",
            "hashes": {
                "sha1": "56178ce7140e1b6458f65494cc330f555da5865d",
                "sha512_sri": "sha512-zgwxXPYh9S1guZnI684/sMyoqcfuGjuDHvWBMJf0QOLtHPT30loYrbmZ2xqccq42A9PLJfYERf2ggQ8Dl8MwVQ=="
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@yeaft/webchat-agent/MAL-2026-10723.json"