registry / @tonbo/yield / 0.3.3
@tonbo/yield@0.3.3
Tonbo Yield: capture your agents' sessions on every machine and list them from any.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe credential-routing and secret-pattern alerts resolve to normal Tonbo account flows and redaction tests. Session capture and content-free metrics are documented, and there is no install lifecycle hook or evidence of unrelated credential collection.
Static reason
One or more suspicious static signals were detected.
Trigger
CLI commands use credentials when invoked; capture runs after users sign in and set up the daemon.
Impact
The package captures agent sessions for the user’s Tonbo account; no unrelated credential transfer or malicious behavior was identified.
Mechanism
The CLI uses Tonbo credentials with the configured Tonbo API origin. The disclosed runtime metrics are content-free and can be disabled.
AI rationale
The credential-routing and secret-pattern alerts resolve to normal Tonbo account flows and redaction tests. Session capture and content-free metrics are documented, and there is no install lifecycle hook or evidence of unrelated credential collection.
Network endpoints3
api.tonbo.devtonbo.devyield.tonbo.io/install.sh
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI binary and has no preinstall, install, or postinstall hook; its scripts are build and development tasks.
- The credential helper reads TONBO_API_KEY or the saved Tonbo login, and the token exchange sends that key to the configured Tonbo service origin.
- The README describes Yield’s core purpose as capturing Claude Code and Codex sessions and running a capture service on each machine.
- The README discloses content-free runtime metrics and documents TONBO_YIELD_METRICS=off.
- The flagged Anthropic key and JWT strings appear in redaction test fixtures, paired with expected redacted output.
Evidence against
- The CLI can capture and upload agent session data after users sign in and set up its capture service; this is sensitive behavior, but it is the documented package purpose.
- The source includes a curl-to-shell upgrade command string, but the package manifest does not run it during installation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
Source & flagged code
5 flaggeddist/bin/yield.jsView file
3488patternName = github_pat
severity = critical
line = 3488
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/bin/yield.jsView on unpkg · L34883488patternName = github_pat
severity = critical
line = 3488
Critical
Secret Pattern
GitHub personal access token in dist/bin/yield.js
dist/bin/yield.jsView on unpkg · L3488•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/bin/yield.js:
import { createInterface } from "node:readline/promises";
await handle.writeFile(`${JSON.stringify(login, null, 2)}
const authorization = new URL("/cli/login", this.loginOrigin);
authorization.search = new URLSearchParams({
return authorization.toString();
listenForCode(expectedState, authorizationUrl, progress2) {
let authorizationStarted = false;
const startAuthorization = (browserOpened = true) => {
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
2 Critical2 High3 Medium5 Low
CriticalCritical Secretdist/bin/yield.js
CriticalSecret Patterndist/bin/yield.js
HighCredential Redirect Persistencedist/bin/yield.js
HighSandbox Evasion Gated Capabilitydist/bin/yield.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @tonbo/yield@0.3.3.
See all versions of @tonbo/yield for other recorded verdicts.
- Review the evidence and your use of @tonbo/yield@0.3.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.