registry / yaver-cli / 1.99.320

yaver-cli@1.99.320

Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime

Static Scan Results

scanned 20h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 21 file(s), 165 KB of source, external domains: api.github.com, github.com, registry.npmjs.org, unpkg.com

Source & flagged code

7 flagged

package.jsonView file

Lines 1-34json

2 "name": "yaver-cli",

3 "version": "1.99.320",

4 "mcpName": "io.github.yaver-io/yaver",

5 "description": "Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime",

6 "bin": {

7 "yaver": "bin/yaver",

8 "yaver-push": "bin/yaver-push",

9 "yaver-mcp": "bin/yaver-mcp",

10 "yaver-cli": "bin/yaver-mcp"

11 },

12 "main": "src/index.js",

13 "scripts": {

14 "postinstall": "node src/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 "preuninstall": "node src/preuninstall.js"

16 },

17 "files": [

18 "bin/",

19 "src/",

20 "hermesc/",

21 "sdk-manifest.json"

22 ],

23 "keywords": [

24 "mcp",

25 "mcp-server",

26 "model-context-protocol",

27 "claude-code",

28 "codex",

29 "ai-agent",

30 "developer-tools",

31 "local-first",

32 "react-native",

33 "testing",

34 "mobile",

src/hermesc-runtime.jsView file

Lines 3-44javascript

3// Runs from `postinstall` on global installs and on-demand from the

4// bundler. Avoids shipping a ~6 MB binary inside the tarball that's

5// only correct for one platform — instead we detect the host and

6// install a matching hermesc at install time.

7//

8// Lookup order (redundant by design; any one succeeding is enough):

9// 1. Cached install under node_modules/yaver-cli/hermesc/<key>/hermesc

10// 2. Per-user cache under ~/.yaver/hermesc/<key>/hermesc

11// 3. Download from the react-native npm tarball and extract just

12// sdks/hermesc/<rn-dir>/hermesc for this platform

src/analyzer.jsView file

Lines 1-21javascript

1const fs = require('fs');

2const semver = require('semver');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analyzer.jsView on unpkg · L1

src/postinstall.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2// npm postinstall hook — prefetch the Yaver agent and provision the

3// Yaver-managed Hermes reload stack on global installs so a fresh

4// Linux/WSL/macOS box can get to headless auth + Open in Yaver

5// without an extra `yaver install mobile` step.

6//

7// Must NEVER fail npm install. This is best-effort bootstrap only.

9const { ensureAgentBinary, runAgentCommand } =

Source & flagged code

7 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code