The @yeaft/webchat-agent package installs itself as a user-level service (systemd on Linux, launchd/PM2 on other platforms) and opens a WebSocket to a configurable server URL. Through this WebSocket, the server can send commands to spawn the user's login shell and send input directly to it, granting interactive shell access to whoever controls the server or can intercept the WebSocket. The package also supports remote self-upgrade by running npm install from a publisher-controlled registry and restarting itself, allowing the remote party to swap the agent's code at will. Additionally, on every startup, it clones a GitHub repository from the main branch into a user directory, sets executable permissions on hook scripts, and enables these plugins, allowing remote code execution via plugin hooks on subsequent boots. The service environment prepends user-local binary paths to PATH, facilitating execution of user-installed binaries. This combination of remote shell access, self-upgrade capability, and plugin installation constitutes a backdoor with full host code execution as the installing user.

An attacker controlling the remote server or able to intercept the WebSocket connection can gain interactive shell access with the privileges of the installing user, enabling full control over the host system. The remote self-upgrade feature allows the attacker to replace the agent's code arbitrarily, and the automatic cloning and enabling of plugins from a GitHub repository provides persistent remote code execution. This creates a severe security risk, effectively a backdoor that compromises the entire host environment where the package is installed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or mitigation is available, users should avoid installing or running the @yeaft/webchat-agent package and remove it from affected systems if present. Network controls to block WebSocket connections to untrusted servers and monitoring for unexpected service installations may help reduce exposure.