registry / @tonbo/yield / 0.3.18
@tonbo/yield@0.3.18
Tonbo Yield: capture your agents' sessions on every machine and list them from any.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged credential patterns are fake filter-test fixtures, while reviewed API traffic targets Tonbo's service. The package's session capture purpose fits the inspected behavior; I found no evidence that the hinted foreign credential routing or gated malicious behavior occurs.
Static reason
One or more suspicious static signals were detected.
Trigger
The CLI runs when invoked; the package has no lifecycle scripts.
Impact
No unrelated credential collection, persistence of a foreign gateway, or hidden download-and-execute behavior was established.
Mechanism
The reviewed paths send requests to Tonbo's API and record limited runtime metrics. The suspicious credential strings are fake examples in filtering tests.
AI rationale
The flagged credential patterns are fake filter-test fixtures, while reviewed API traffic targets Tonbo's service. The package's session capture purpose fits the inspected behavior; I found no evidence that the hinted foreign credential routing or gated malicious behavior occurs.
Evidence
package.jsondist/bin/yield.js
Network endpoints1
api.tonbo.dev
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes Yield as capturing and listing agent sessions, and exposes a CLI entry point.
- API requests use Tonbo's service origin by default; a custom origin must use HTTPS, except for loopback.
- The flagged API-key patterns occur in bundled filter test vectors explicitly described as fake secrets.
- Session capture applies secret filtering to team sessions before recording their lines.
Evidence against
- Runtime metrics are enabled by default, can be disabled with TONBO_YIELD_METRICS=off, and include metric values plus optional session and handoff UUIDs.
- Personal session lines are not passed through the team-session secret filter.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/bin/yield.jsView file
3787patternName = github_pat
severity = critical
line = 3787
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/bin/yield.jsView on unpkg · L37873787patternName = github_pat
severity = critical
line = 3787
Critical
Secret Pattern
GitHub personal access token in dist/bin/yield.js
dist/bin/yield.jsView on unpkg · L3787•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/bin/yield.js:
import { mkdir as mkdir15, readFile as readFile21, stat as stat10, writeFile as writeFile6 } from "node:fs/promises";
import { createInterface as createInterface2 } from "node:readline/promises";
await handle.writeFile(`${JSON.stringify(login, null, 2)}
const authorization = new URL("/cli/login", this.loginOrigin);
authorization.search = new URLSearchParams({
return authorization.toString();
step: "device-authorization",
progress2({ status: "started", step: "device-authorization" });
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
2 Critical2 High3 Medium5 Low
CriticalCritical Secretdist/bin/yield.js
CriticalSecret Patterndist/bin/yield.js
HighCredential Redirect Persistencedist/bin/yield.js
HighSandbox Evasion Gated Capabilitydist/bin/yield.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to @tonbo/yield@0.3.18.
See all versions of @tonbo/yield for other recorded verdicts.
- Review the evidence and your use of @tonbo/yield@0.3.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.