Running the yorn CLI activates an obfuscated loader that dynamically reconstructs opaque code. No confirmed exfiltration or install-time attack was established from readable source.
Package source references a known benign dynamic code generation pattern.
dist/load.jsView on unpkg · L1Package ships non-JavaScript build or shell helper files.
dist/skills/screenshot/scripts/take_screenshot.pyView on unpkgPackage ships high-entropy non-source blobs.
dist/skills/theme-factory/theme-showcase.pdfView on unpkgThe advertised CLI entrypoint is an opaque, heavily obfuscated loader.
package.jsonView on unpkg · L4The loader uses dynamic Function construction and invokes a reconstructed runtime function.
dist/load.cjsView on unpkg · L2The loader uses dynamic Function construction and invokes a reconstructed runtime function.
dist/load.cjsView on unpkg · L2Package source references a known benign dynamic code generation pattern.
dist/load.jsView on unpkg · L1Package ships non-JavaScript build or shell helper files.
dist/skills/screenshot/scripts/take_screenshot.pyView on unpkgPackage ships high-entropy non-source blobs.
dist/skills/theme-factory/theme-showcase.pdfView on unpkgThe advertised CLI entrypoint is an opaque, heavily obfuscated loader.
package.jsonView on unpkg · L4The loader uses dynamic Function construction and invokes a reconstructed runtime function.
dist/load.cjsView on unpkg · L2The loader uses dynamic Function construction and invokes a reconstructed runtime function.
dist/load.cjsView on unpkg · L2