registry / @siwatfa/yorn / 1.0.76

@siwatfa/yorn@1.0.76

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Running the yorn command executes opaque loader code and compiled V8 bytecode. Interactive use also documents an automatic global self-update path; no install-time attack was established.

Static reason

No blocking static signals were detected.

Trigger

User runs yorn, especially interactive mode.

Impact

Opaque runtime code can access the capabilities of a coding-agent CLI; its exact behavior cannot be verified statically from the shipped bytecode.

Mechanism

Obfuscated dynamic loader and bytecode-backed CLI with self-update.

Rationale

The opaque bytecode and dynamic loader create a real unresolved runtime risk, warranting a warning. There is insufficient concrete source evidence to classify the package as malicious or block it.

Evidence

package.jsondist/load.cjsdist/load.jsdist/yorn.jscREADME.md~/.yorn/agent/

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-14102

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @siwatfa/yorn (npm)

Details

The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: ghsa-malware (dc765ce6cbae92d77218173fda23eca5505d5dc8342010b79f87ad721aac882a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Unknown with medium false-positive risk.

Evidence for block

The user-invoked yorn bin runs heavily obfuscated loaders through Function().
The package ships a 15.5 MB compiled V8 bytecode artifact whose behavior is not source-auditable.
Documentation states interactive startup can open a terminal and globally reinstall the package.

Evidence against

package.json has only a prepublishOnly lifecycle hook; no install-time hook is declared.
The bytecode/obfuscation is explicitly documented as the package build output.
No concrete credential exfiltration, destructive action, or foreign AI-agent control-surface mutation was confirmed from inspectable source.

Behavioral surface

Source

Eval

Supply chain

MinifiedPossibleObfuscationTrivial

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 129 KB of source

Source & flagged code

6 flagged

dist/load.jsView file

1#!/usr/bin/env node L2: import"./load.cjs";Function("stxmbZ","var vYqzLi,XrMwYb,dIXUnx,FQkmyZ,NyUDSk,Rfn8Hid,kfHYx6e,dbhLnFu,J_K_g3U;function tCLJ5e(vYqzLi){var XrMwYb=(vYqzLi|0x0)^0x9e3779b9,dIXUnx=0x243...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/load.jsView on unpkg · L1

dist/yorn.jscView file

•path = dist/yorn.jsc kind = node_bytecode sizeBytes = 15523280 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/yorn.jscView on unpkg

dist/skills/screenshot/scripts/take_screenshot.pyView file

•path = dist/skills/screenshot/scripts/take_screenshot.py kind = build_helper sizeBytes = 19659 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/screenshot/scripts/take_screenshot.pyView on unpkg

dist/skills/theme-factory/theme-showcase.pdfView file

•path = dist/skills/theme-factory/theme-showcase.pdf kind = high_entropy_blob sizeBytes = 124310 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/theme-factory/theme-showcase.pdfView on unpkg

README.mdView file

74## Development ```sh npm install npm run build # generate models, obfuscate secret logic, compile to V8 bytecode (dist/yorn.jsc), and build loader npm run yorn # run from source with tsx

High

Ai Review Evidence

The package ships a 15.5 MB compiled V8 bytecode artifact whose behavior is not source-auditable.

README.mdView on unpkg · L74

42## Self-update Every interactive start, yorn compares its own version with the latest published version of `@siwatfa/yorn` on the npm registry. When a newer version exists, yorn opens a new terminal window that runs the global install (for example `npm install -g @siwatfa/yorn@latest`) and exits the outdated instance. Once the install finishes, start `yorn` again.

High

Ai Review Evidence

Documentation states interactive startup can open a terminal and globally reinstall the package.

README.mdView on unpkg · L42

Source & flagged code

6 flagged · loading source

dist/load.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/load.jsView on unpkg · L1

dist/yorn.jscView file

•path = dist/yorn.jsc kind = node_bytecode sizeBytes = 15523280 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/yorn.jscView on unpkg

dist/skills/screenshot/scripts/take_screenshot.pyView file

•path = dist/skills/screenshot/scripts/take_screenshot.py kind = build_helper sizeBytes = 19659 magicHex = [redacted]

Findings

4 High2 Medium3 Low

HighShips Node Bytecodedist/yorn.jsc

HighShips High Entropy Blobdist/skills/theme-factory/theme-showcase.pdf

HighAi Review EvidenceREADME.md

MediumShips Build Helperdist/skills/screenshot/scripts/take_screenshot.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/load.js