Running the yorn CLI invokes an obfuscated dynamic loader and packaged V8 bytecode. The stated agent capability includes project file access and command execution, but no concrete malicious chain is visible.
A second loader is likewise obfuscated and dynamically evaluated.
dist/load.jsView on unpkg · L2Package source references a known benign dynamic code generation pattern.
dist/load.jsView on unpkg · L1Package ships non-JavaScript build or shell helper files.
dist/skills/screenshot/scripts/take_screenshot.pyView on unpkgPackage ships high-entropy non-source blobs.
dist/skills/theme-factory/theme-showcase.pdfView on unpkgCLI loader executes an opaque dynamic Function payload.
dist/load.cjsView on unpkg · L2README confirms intentional obfuscation and V8 bytecode compilation.
README.mdView on unpkg · L78Documented runtime agent can read/edit files and execute commands.
README.mdView on unpkg · L3No install hook is declared; the only lifecycle hook is prepublishOnly.
package.jsonView on unpkg · L21A second loader is likewise obfuscated and dynamically evaluated.
dist/load.jsView on unpkg · L2Package source references a known benign dynamic code generation pattern.
dist/load.jsView on unpkg · L1Package ships non-JavaScript build or shell helper files.
dist/skills/screenshot/scripts/take_screenshot.pyView on unpkgPackage ships high-entropy non-source blobs.
dist/skills/theme-factory/theme-showcase.pdfView on unpkgCLI loader executes an opaque dynamic Function payload.
dist/load.cjsView on unpkg · L2README confirms intentional obfuscation and V8 bytecode compilation.
README.mdView on unpkg · L78Documented runtime agent can read/edit files and execute commands.
README.mdView on unpkg · L3No install hook is declared; the only lifecycle hook is prepublishOnly.
package.jsonView on unpkg · L21