registry / @siwatfa/yorn / 1.0.71

@siwatfa/yorn@1.0.71

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Explicitly invoking yorn runs an obfuscated dynamic loader and opaque V8 bytecode. The bytecode's actions cannot be statically audited from the shipped readable source.

Static reason

No blocking static signals were detected.

Trigger

User invokes the yorn CLI.

Impact

Opaque code executes with the invoking user's privileges.

Mechanism

Obfuscated Function-based loader executing compiled bytecode.

Rationale

No concrete malicious chain was proven, but the active command's opaque bytecode and dynamic obfuscated loader create an unresolved executable payload risk. Warn rather than block because it is user-invoked and no install-time mutation or confirmed harmful action is visible.

Evidence

package.jsondist/load.cjsdist/load.jsdist/yorn.jscREADME.md

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-14102

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @siwatfa/yorn (npm)

Details

The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: ghsa-malware (dc765ce6cbae92d77218173fda23eca5505d5dc8342010b79f87ad721aac882a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Unknown with medium false-positive risk.

Evidence for block

The CLI entrypoint is an obfuscated loader that dynamically constructs code with Function.
The package ships opaque V8 bytecode, expressly described as compiled from obfuscated logic.
The opaque loader is the command executed by the published yorn bin.

Evidence against

No preinstall, install, or postinstall hook is declared.
Activation requires an explicit yorn CLI invocation.
No concrete exfiltration endpoint or destructive action is verifiable from readable source.

Behavioral surface

Source

Eval

Supply chain

MinifiedPossibleObfuscationTrivial

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 75.7 KB of source

Source & flagged code

5 flagged

dist/load.jsView file

1#!/usr/bin/env node L2: import"./load.cjs";Function("SM_tAd9","var lUiIex,NcGPACz,u5Ly1eE,FJ3vwt,dbj9Wh,FdoYN1E,Mboyhhk,NPjAXt9;function KfJbI6m(lUiIex){var NcGPACz=(lUiIex|0x0)^0x9e3779b9,u5Ly1eE=0x243f6...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/load.jsView on unpkg · L1

dist/yorn.jscView file

•path = dist/yorn.jsc kind = node_bytecode sizeBytes = 15521592 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/yorn.jscView on unpkg

dist/load.cjsView file

2Function("n8SI0aH","\"use strict\";var

High

Ai Review Evidence

The CLI entrypoint is an obfuscated loader that dynamically constructs code with Function.

dist/load.cjsView on unpkg · L2

README.mdView file

78npm run build # generate models, obfuscate secret logic, compile to V8 bytecode (dist/yorn.jsc), and build loader

High

Ai Review Evidence

The package ships opaque V8 bytecode, expressly described as compiled from obfuscated logic.

README.mdView on unpkg · L78

package.jsonView file

6"bin": { "yorn": "dist/load.cjs" }

High

Ai Review Evidence

The opaque loader is the command executed by the published yorn bin.

package.jsonView on unpkg · L6

Source & flagged code

5 flagged · loading source

dist/load.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/load.jsView on unpkg · L1

dist/yorn.jscView file

•path = dist/yorn.jsc kind = node_bytecode sizeBytes = 15521592 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/yorn.jscView on unpkg

dist/load.cjsView file

2Function("n8SI0aH","\"use strict\";var

High

Ai Review Evidence

Findings

4 High3 Low

HighShips Node Bytecodedist/yorn.jsc

HighAi Review Evidencedist/load.cjs

HighAi Review EvidenceREADME.md

HighAi Review Evidencepackage.json

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/load.js