registry / @siwatfa/yorn / 1.0.102

@siwatfa/yorn@1.0.102

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The user-invoked yorn CLI loads opaque bytecode for an AI coding agent. It can operate on the current project and self-update from npm at interactive startup; no install-time attack was confirmed.

Static reason

No blocking static signals were detected.

Trigger

Running `yorn` interactively or invoking its CLI.

Impact

The opaque runtime may read/edit project files and execute commands; automatic updates extend the trusted code path.

Mechanism

Obfuscated loader executes compiled AI-agent bytecode.

Rationale

No concrete malicious chain was established, so blocking is not justified. The opaque bytecode plus command-executing agent and automatic update behavior warrants a warning.

Evidence

package.jsondist/load.cjsdist/yorn.jscREADME.md~/.yorn/agent/auth.json.yorn/settings.json

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-14102

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @siwatfa/yorn (npm)

Details

The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: ghsa-malware (dc765ce6cbae92d77218173fda23eca5505d5dc8342010b79f87ad721aac882a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for block

CLI loader dynamically evaluates obfuscated code and loads compiled V8 bytecode.
Documented runtime agent reads/edits project files and executes commands.
Interactive startup performs an automatic package-aligned npm self-update.
Core executable behavior is opaque because it is shipped as bytecode.

Evidence against

No preinstall, install, or postinstall lifecycle hook is declared.
The risky capabilities are documented as user-invoked CLI functionality.
No concrete credential exfiltration, destructive action, or foreign agent-config mutation was confirmed.

Behavioral surface

Source

Eval

Supply chain

MinifiedTrivial

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 63.6 KB of source

Source & flagged code

8 flagged

dist/load.jsView file

1#!/usr/bin/env node L2: import"./load.cjs";Function("cZpdw_","var lKXmGVr,JgeZF_,Ff4w_k,_4Hzr7,sB9yR9Z,UgrrPM,reim0s,ASumu4;const RalFB7_=[0x0,0x1,0x8,0xff,\"\\x6c\\x65\\x6e\\x67\\x74\\x68\",0x7b,\"\\x67\...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/load.jsView on unpkg · L1

dist/yorn.jscView file

•path = dist/yorn.jsc kind = node_bytecode sizeBytes = 15524664 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/yorn.jscView on unpkg

dist/skills/screenshot/scripts/take_screenshot.pyView file

•path = dist/skills/screenshot/scripts/take_screenshot.py kind = build_helper sizeBytes = 19659 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/screenshot/scripts/take_screenshot.pyView on unpkg

dist/skills/theme-factory/theme-showcase.pdfView file

•path = dist/skills/theme-factory/theme-showcase.pdf kind = high_entropy_blob sizeBytes = 124310 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/theme-factory/theme-showcase.pdfView on unpkg

dist/load.cjsView file

2Function("uMMWDE8",

High

Ai Review Evidence

CLI loader dynamically evaluates obfuscated code and loads compiled V8 bytecode.

dist/load.cjsView on unpkg · L2

README.mdView file

3Yorn is a terminal AI coding agent. It runs in your terminal, reads and edits your files, executes commands, and helps you get real work done in your codebase.

High

Ai Review Evidence

Documented runtime agent reads/edits project files and executes commands.

README.mdView on unpkg · L3

44Every interactive start, yorn compares its own version with the latest published version of `@siwatfa/yorn` on the npm registry. When a newer version exists, yorn opens a new terminal window that runs the global install (for example `npm install -g @siwatfa/yorn@latest`) and exits the outdated instance.

High

Ai Review Evidence

Interactive startup performs an automatic package-aligned npm self-update.

README.mdView on unpkg · L44

78npm run build # generate models, obfuscate secret logic, compile to V8 bytecode (dist/yorn.jsc), and build loader

High

Ai Review Evidence

Core executable behavior is opaque because it is shipped as bytecode.

README.mdView on unpkg · L78

Source & flagged code

8 flagged · loading source

dist/load.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/load.jsView on unpkg · L1

dist/yorn.jscView file

•path = dist/yorn.jsc kind = node_bytecode sizeBytes = 15524664 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/yorn.jscView on unpkg

dist/skills/screenshot/scripts/take_screenshot.pyView file

•path = dist/skills/screenshot/scripts/take_screenshot.py kind = build_helper sizeBytes = 19659 magicHex = [redacted]

Findings

6 High2 Medium3 Low

HighShips Node Bytecodedist/yorn.jsc

HighShips High Entropy Blobdist/skills/theme-factory/theme-showcase.pdf

HighAi Review Evidencedist/load.cjs

HighAi Review EvidenceREADME.md

MediumShips Build Helperdist/skills/screenshot/scripts/take_screenshot.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/load.js