registry / @tonbo/yield / 0.3.21
@tonbo/yield@0.3.21
Tonbo Yield: capture your agents' sessions on every machine and list them from any.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe manifest exposes a CLI without install lifecycle hooks, and the credential-looking strings are explicitly fake redaction-test fixtures. The inspected network destinations are Tonbo services or the npm registry, consistent with the package’s stated session capture and update features.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs a CLI command or explicitly installs and starts the capture service.
Impact
No concrete malicious behavior was found. Session capture and related service requests are consistent with the package’s stated purpose.
Mechanism
The CLI uses Tonbo credentials with Tonbo API, Git, and Streams services. The detected external API-key patterns are fake values in redaction test vectors.
AI rationale
The manifest exposes a CLI without install lifecycle hooks, and the credential-looking strings are explicitly fake redaction-test fixtures. The inspected network destinations are Tonbo services or the npm registry, consistent with the package’s stated session capture and update features.
Network endpoints5
api.tonbo.devgit.tonbo.devstreams.tonbo.devregistry.npmjs.orgyield.tonbo.io
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a CLI for capturing and listing agent sessions; the CLI is exposed as a user-run command.
- The manifest has no install, preinstall, or postinstall lifecycle script.
- The apparent API-key strings occur in filter test vectors, which explicitly say their secrets are fake.
- The source exchanges Tonbo credentials for tokens for Tonbo’s Streams and Git services.
- Metrics can be disabled with TONBO_YIELD_METRICS=off; the metric sender includes event data and optional session or handoff IDs.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/bin/yield.jsView file
3790patternName = github_pat
severity = critical
line = 3790
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/bin/yield.jsView on unpkg · L37903790patternName = github_pat
severity = critical
line = 3790
Critical
Secret Pattern
GitHub personal access token in dist/bin/yield.js
dist/bin/yield.jsView on unpkg · L3790•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/bin/yield.js:
import { mkdir as mkdir15, readFile as readFile22, stat as stat10, writeFile as writeFile6 } from "node:fs/promises";
import { createInterface as createInterface2 } from "node:readline/promises";
await handle.writeFile(`${JSON.stringify(login, null, 2)}
const authorization = new URL("/cli/login", this.loginOrigin);
authorization.search = new URLSearchParams({
return authorization.toString();
step: "device-authorization",
progress2({ status: "started", step: "device-authorization" });
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
2 Critical2 High3 Medium5 Low
CriticalCritical Secretdist/bin/yield.js
CriticalSecret Patterndist/bin/yield.js
HighCredential Redirect Persistencedist/bin/yield.js
HighSandbox Evasion Gated Capabilitydist/bin/yield.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to @tonbo/yield@0.3.21.
See all versions of @tonbo/yield for other recorded verdicts.
- Review the evidence and your use of @tonbo/yield@0.3.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.