registry / @siwatfa/yorn / 1.0.86

@siwatfa/yorn@1.0.86

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No install-time attack is established. On explicit CLI use, opaque bytecode implements an AI coding agent that can access the current project and execute commands; interactive use also self-updates via npm.

Static reason

No blocking static signals were detected.

Trigger

User runs yorn interactively or invokes its update behavior.

Impact

A user-invoked coding agent can modify project files and run commands; bytecode opacity prevents full source-level verification.

Mechanism

Obfuscated Function-based loader executes bundled V8 bytecode for an AI coding CLI.

Rationale

This is not a confirmed malicious install-time package, but its opaque bytecode and user-invoked agent command/file capabilities leave a meaningful unresolved dangerous-capability surface. Downgrade to warn rather than block.

Evidence

package.jsonREADME.mddist/load.cjsdist/load.jsdist/yorn.jscdist/skills/screenshot/scripts/ensure_macos_permissions.sh~/.yorn/agent/auth.json

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-14102

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @siwatfa/yorn (npm)

Details

The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: ghsa-malware (dc765ce6cbae92d77218173fda23eca5505d5dc8342010b79f87ad721aac882a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for block

The executable loader invokes dynamically generated code through Function().
The package ships opaque V8 bytecode (dist/yorn.jsc); README confirms the build compiles it to bytecode.
The documented CLI reads/edits project files and executes commands when the user runs it.
Interactive startup performs a self-update check and may invoke a global npm install.

Evidence against

package.json has no preinstall, install, or postinstall hook; prepublishOnly is publisher-time only.
The documented filesystem and command capabilities are user-invoked CLI behavior, not install-time execution.
No concrete credential exfiltration, foreign agent-config mutation, or destructive chain was confirmed from inspected files.

Behavioral surface

Source

Eval

Supply chain

MinifiedPossibleObfuscationTrivial

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 87.3 KB of source

Source & flagged code

8 flagged

dist/load.jsView file

1#!/usr/bin/env node L2: import"./load.cjs";Function("IR62ld","var C2C3hG,CBi8QhT,mLwY9q,cNLqMX,FYyD8FW,Sn8j6po,i1xMdi,j4PPgVZ;function LTcX0w(C2C3hG){var CBi8QhT=(C2C3hG|0x0)^0x9e3779b9,mLwY9q=0x243f6a88|...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/load.jsView on unpkg · L1

dist/yorn.jscView file

•path = dist/yorn.jsc kind = node_bytecode sizeBytes = 15535464 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/yorn.jscView on unpkg

dist/skills/screenshot/scripts/take_screenshot.pyView file

•path = dist/skills/screenshot/scripts/take_screenshot.py kind = build_helper sizeBytes = 19659 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/screenshot/scripts/take_screenshot.pyView on unpkg

dist/skills/theme-factory/theme-showcase.pdfView file

•path = dist/skills/theme-factory/theme-showcase.pdf kind = high_entropy_blob sizeBytes = 124310 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/theme-factory/theme-showcase.pdfView on unpkg

dist/load.cjsView file

2Function("XlpzAp",

High

Ai Review Evidence

The executable loader invokes dynamically generated code through Function().

dist/load.cjsView on unpkg · L2

README.mdView file

77npm install npm run build # generate models, obfuscate secret logic, compile to V8 bytecode (dist/yorn.jsc), and build loader npm run yorn

High

Ai Review Evidence

The package ships opaque V8 bytecode (dist/yorn.jsc); README confirms the build compiles it to bytecode.

README.mdView on unpkg · L77

3Yorn is a terminal AI coding agent. It runs in your terminal, reads and edits your files, executes commands, and helps you get real work done in your codebase.

High

Ai Review Evidence

The documented CLI reads/edits project files and executes commands when the user runs it.

README.mdView on unpkg · L3

42## Self-update Every interactive start, yorn compares its own version with the latest published version of `@siwatfa/yorn` on the npm registry. When a newer version exists, yorn opens a new terminal window that runs the global install (for example `npm install -g @siwatfa/yorn@latest`) and exits the outdated instance. Once the install finishes, start `yorn` again.

High

Ai Review Evidence

Interactive startup performs a self-update check and may invoke a global npm install.

README.mdView on unpkg · L42

Source & flagged code

8 flagged · loading source

dist/load.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/load.jsView on unpkg · L1

dist/yorn.jscView file

•path = dist/yorn.jsc kind = node_bytecode sizeBytes = 15535464 magicHex = [redacted]

High

Ships Node Bytecode

Package ships compiled Node/V8 bytecode artifacts.

dist/yorn.jscView on unpkg

dist/skills/screenshot/scripts/take_screenshot.pyView file

•path = dist/skills/screenshot/scripts/take_screenshot.py kind = build_helper sizeBytes = 19659 magicHex = [redacted]

Findings

6 High2 Medium3 Low

HighShips Node Bytecodedist/yorn.jsc

HighShips High Entropy Blobdist/skills/theme-factory/theme-showcase.pdf

HighAi Review Evidencedist/load.cjs

HighAi Review EvidenceREADME.md

MediumShips Build Helperdist/skills/screenshot/scripts/take_screenshot.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/load.js