Explicit invocation of yorn runs an obfuscated dynamic loader and opaque bytecode. No install-time execution or confirmed malicious behavior was established.
Package source references a known benign dynamic code generation pattern.
dist/load.jsView on unpkg · L1Package ships non-JavaScript build or shell helper files.
dist/skills/screenshot/scripts/take_screenshot.pyView on unpkgPackage ships high-entropy non-source blobs.
dist/skills/theme-factory/theme-showcase.pdfView on unpkgThe CLI entrypoint is an obfuscated Function-based loader.
dist/load.cjsView on unpkg · L1The package ships a 15 MB opaque V8 bytecode artifact.
package.jsonView on unpkg · L6Package source references a known benign dynamic code generation pattern.
dist/load.jsView on unpkg · L1Package ships non-JavaScript build or shell helper files.
dist/skills/screenshot/scripts/take_screenshot.pyView on unpkgPackage ships high-entropy non-source blobs.
dist/skills/theme-factory/theme-showcase.pdfView on unpkgThe CLI entrypoint is an obfuscated Function-based loader.
dist/load.cjsView on unpkg · L1The package ships a 15 MB opaque V8 bytecode artifact.
package.jsonView on unpkg · L6