registry / @tonbo/yield / 0.3.9
@tonbo/yield@0.3.9
Tonbo Yield: capture your agents' sessions on every machine and list them from any.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe apparent OpenAI and Anthropic credential indicators are test-fixture strings, while the bundled authentication uses Tonbo credentials and its own API. Session capture and runtime metrics are described in the README as core functionality, with metrics content limits and an opt-out.
Static reason
One or more suspicious static signals were detected.
Trigger
The user invokes the yield CLI and signs in or starts its capture service.
Impact
Session data is uploaded for the package's stated service; no unrelated credential redirection or malicious behavior was found.
Mechanism
The CLI uses Tonbo credentials with the Tonbo API and documents what session data and content-free metrics it captures.
AI rationale
The apparent OpenAI and Anthropic credential indicators are test-fixture strings, while the bundled authentication uses Tonbo credentials and its own API. Session capture and runtime metrics are described in the README as core functionality, with metrics content limits and an opt-out.
Network endpoints3
api.tonbo.devyield.tonbo.ioregistry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes its purpose as capturing Claude Code and Codex sessions and listing them across the user's devices.
- The bundled credential loader uses a Tonbo-specific key or saved Tonbo login; the default API host is api.tonbo.dev.
- The OpenAI credential pattern appears inside a test fixture showing an example line and its filtered output, not credential collection logic.
- README documents the runtime metrics as content-free and says they exclude tasks, prompts, paths, and reasons.
Evidence against
- The CLI captures agent sessions and snapshots Git work trees, which is substantial data handling but matches the stated package purpose.
- The package records runtime metrics by default; README describes the metrics and provides TONBO_YIELD_METRICS=off to disable them.
- The bundle contains a curl-to-shell installer command for upgrading, but it targets the package's own yield.tonbo.io host.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
5 flaggeddist/bin/yield.jsView file
3561patternName = github_pat
severity = critical
line = 3561
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/bin/yield.jsView on unpkg · L35613561patternName = github_pat
severity = critical
line = 3561
Critical
Secret Pattern
GitHub personal access token in dist/bin/yield.js
dist/bin/yield.jsView on unpkg · L3561•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/bin/yield.js:
import { createInterface as createInterface2 } from "node:readline/promises";
await handle.writeFile(`${JSON.stringify(login, null, 2)}
const authorization = new URL("/cli/login", this.loginOrigin);
authorization.search = new URLSearchParams({
return authorization.toString();
listenForCode(expectedState, authorizationUrl, progress2) {
let authorizationStarted = false;
const startAuthorization = (browserOpened = true) => {
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
2 Critical2 High3 Medium5 Low
CriticalCritical Secretdist/bin/yield.js
CriticalSecret Patterndist/bin/yield.js
HighCredential Redirect Persistencedist/bin/yield.js
HighSandbox Evasion Gated Capabilitydist/bin/yield.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review EvidenceREADME.md
Affected versions and remediation
This report applies to @tonbo/yield@0.3.9.
See all versions of @tonbo/yield for other recorded verdicts.
- Review the evidence and your use of @tonbo/yield@0.3.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.