registry / @tonbo/yield / 0.3.7
@tonbo/yield@0.3.7
Tonbo Yield: capture your agents' sessions on every machine and list them from any.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe bundle’s credential indicators are fake test data, while inspected credentials and network requests serve the documented Tonbo session-capture CLI. The background capture service starts through personal-account login, consistent with the package’s stated behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs the CLI, signs in, or installs the capture service.
Impact
Session capture and account operations occur as described by the package; no unrelated credential transfer or hidden account action was found.
Mechanism
The CLI captures agent sessions and uses Tonbo services for its documented account, session, and Git operations.
AI rationale
The bundle’s credential indicators are fake test data, while inspected credentials and network requests serve the documented Tonbo session-capture CLI. The background capture service starts through personal-account login, consistent with the package’s stated behavior.
Evidence
package.jsonREADME.mddist/bin/yield.js
Network endpoints4
api.tonbo.devgit.tonbo.devstreams.tonbo.devyield.tonbo.io
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package is a CLI whose stated purpose is to capture and manage Claude Code and Codex sessions.
- The persistent capture service is installed and started as part of personal-account login, matching the package’s stated function.
- Project connection is a distinct CLI action; team visibility and sharing are described to the user.
- The apparent OpenAI and Anthropic credential findings are bundled test vectors; the Anthropic key is explicitly fake and redacted in the expected result.
- The CLI’s default management API is api.tonbo.dev, and the inspected Git request sends a Tonbo access token to the configured Tonbo Git origin.
- Runtime metrics are documented as content-free, with an environment variable to disable them.
Evidence against
- Personal-account login starts a persistent background service that captures agent sessions, which can include sensitive content, but this is the documented core function.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
Source & flagged code
5 flaggeddist/bin/yield.jsView file
3542patternName = github_pat
severity = critical
line = 3542
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/bin/yield.jsView on unpkg · L35423542patternName = github_pat
severity = critical
line = 3542
Critical
Secret Pattern
GitHub personal access token in dist/bin/yield.js
dist/bin/yield.jsView on unpkg · L3542•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/bin/yield.js:
import { createInterface as createInterface2 } from "node:readline/promises";
await handle.writeFile(`${JSON.stringify(login, null, 2)}
const authorization = new URL("/cli/login", this.loginOrigin);
authorization.search = new URLSearchParams({
return authorization.toString();
listenForCode(expectedState, authorizationUrl, progress2) {
let authorizationStarted = false;
const startAuthorization = (browserOpened = true) => {
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
2 Critical2 High3 Medium5 Low
CriticalCritical Secretdist/bin/yield.js
CriticalSecret Patterndist/bin/yield.js
HighCredential Redirect Persistencedist/bin/yield.js
HighSandbox Evasion Gated Capabilitydist/bin/yield.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review EvidenceREADME.md
Affected versions and remediation
This report applies to @tonbo/yield@0.3.7.
See all versions of @tonbo/yield for other recorded verdicts.
- Review the evidence and your use of @tonbo/yield@0.3.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.