registry / @tonbo/yield / 0.3.2
@tonbo/yield@0.3.2
Tonbo Yield: capture your agents' sessions on every machine and list them from any.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe source matches the package’s stated purpose: a CLI that captures agent sessions and uses the configured Tonbo service. The flagged secret is fake test data, and no install-time contact or forwarding of third-party credentials was identified.
Static reason
One or more suspicious static signals were detected.
Trigger
The CLI runs when invoked; the manifest declares no install lifecycle hook.
Impact
No malicious impact identified from the inspected source.
Mechanism
It sends its Tonbo credential as a Bearer key to the configured API origin, defaulting to api.tonbo.dev. No automatic forwarding of third-party credentials was found.
AI rationale
The source matches the package’s stated purpose: a CLI that captures agent sessions and uses the configured Tonbo service. The flagged secret is fake test data, and no install-time contact or forwarding of third-party credentials was identified.
Network endpoints2
api.tonbo.devyield.tonbo.io
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes Yield as a CLI for capturing agents’ sessions across machines, and its manifest exposes a `yield` command.
- The bundled default API host is `api.tonbo.dev`; a custom API origin comes from `TONBO_API_ORIGIN`, with HTTPS required except for loopback.
- Management requests send a Bearer key to a URL built from the configured API origin.
- The Anthropic key pattern flagged by the scanner appears in a redaction test vector labeled with fake credentials.
- The suggested curl installer command is presented as a status-check fix, not run automatically.
Evidence against
- The manifest has no install, preinstall, or postinstall lifecycle hook.
- The apparent third-party credential matches are test data; no actual read or forwarding of OpenAI or Anthropic credentials was identified.
- The upgrade command is shown as a suggested fix in status diagnostics.
- The bundled CLI sends its Tonbo key to its configured Tonbo API origin as part of its service functionality.
Behavioral surface
ChildProcessCrypto
Source & flagged code
5 flaggeddist/bin/yield.jsView file
3471patternName = github_pat
severity = critical
line = 3471
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/bin/yield.jsView on unpkg · L34713471patternName = github_pat
severity = critical
line = 3471
Critical
Secret Pattern
GitHub personal access token in dist/bin/yield.js
dist/bin/yield.jsView on unpkg · L3471•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/bin/yield.js:
import { createInterface } from "node:readline/promises";
await handle.writeFile(`${JSON.stringify(login, null, 2)}
const authorization = new URL("/cli/login", this.loginOrigin);
authorization.search = new URLSearchParams({
return authorization.toString();
listenForCode(expectedState, authorizationUrl, progress2) {
let authorizationStarted = false;
const startAuthorization = (browserOpened = true) => {
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
2 Critical2 High3 Medium5 Low
CriticalCritical Secretdist/bin/yield.js
CriticalSecret Patterndist/bin/yield.js
HighCredential Redirect Persistencedist/bin/yield.js
HighSandbox Evasion Gated Capabilitydist/bin/yield.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to @tonbo/yield@0.3.2.
See all versions of @tonbo/yield for other recorded verdicts.
- Review the evidence and your use of @tonbo/yield@0.3.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.