[Question]: Why LibreChat creates these orcexec.* files?

[gafda]

What is your question?

My firewall capture unusual behavior within the container of LibreChat v0.6.6 stating:

* Process name: node
* Process binary fullpath: /usr/local/bin/node
* Library name: /root/orcexec.aibHLp (deleted)

This finding poses a high risk because it indicates that an attacker may have access to the system and is able to execute arbitrary code.

What is this exectly? Why does it create this? Can this be avoided?

More Details

My instance is completely vanilla with a single connection to AzureOpenAI. I haven't added plugins or any other stuff...

What is the main subject of your question?

Other

Screenshots

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[danny-avila]

Seems like an artifact from running the node:alpine linux container: lovell/sharp#1039

I would not worry about it since this docker image has no vulnerabilities but there are instructions on how to disable it in the link I sent:

[danny-avila]

more info: https://github.com/GStreamer/orc

It is likely used by the sharp package under a specific linux env, makes sense they would report this as well since we use the sharp package in this project.