Skip to main content
MalwarePublished Updated

@yeaft/webchat-agent (npm) · Malicious Code

Affects @yeaft/webchat-agentSource GCVE Database

0

Malicious package : remove @yeaft/webchat-agent and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 18:40 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10723

What to do

Remove @yeaft/webchat-agent from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

ProductAffectedFixed in
npm@yeaft/webchat-agentAffected
  • 1.0.171 – 1.0.384
147 affected builds		Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The @yeaft/webchat-agent npm package installs a user-level service that opens a WebSocket connection to a configurable server. This connection allows remote commands to spawn an interactive shell as the installing user, effectively providing full host code execution. The package also supports remote self-upgrade from a publisher-controlled registry and clones a GitHub repository on startup to install executable plugin hooks, enabling persistent remote code execution. These behaviors constitute a backdoor with a high risk of compromise for any system running the affected versions.

References

Community reviews

Loading reviews…