Loading npm security reports…

yaver-cli@1.99.349: AI-agent policy block | LPM Firewall

registry / yaver-cli / 1.99.349

yaver-cli@1.99.349

Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. A global npm install silently provisions and executes a remote agent, then registers Yaver MCP with existing AI coding clients. It can also install software, alter shell startup files, and modify host sandbox settings when privileged.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install -g yaver-cli (unless opted out through YAVER_SKIP_POSTINSTALL variables)

Impact

Unconsented modification of Codex/Claude/OpenCode control surfaces and broad host persistence/configuration changes.

Mechanism

postinstall remote binary execution and foreign AI-agent MCP configuration

Policy narrative

On global installation, the lifecycle hook fetches a latest GitHub release binary without a pinned checksum or signature and executes it. The same unattended hook installs AI runners if missing and invokes that downloaded agent to register Yaver MCP in existing Codex, Claude Code, and OpenCode configurations; privileged paths additionally change sysctl and install OS packages.

Rationale

This is concrete unconsented postinstall mutation of foreign AI-agent control surfaces, combined with remote binary execution and broad host changes. It meets the firewall block policy irrespective of the package's stated developer-tool purpose.

Evidence

package.jsonsrc/postinstall.jssrc/agent-runtime.jssrc/preuninstall.js/etc/sysctl.d/99-yaver-runner-sandbox.conf~/.bashrc~/.zshrc~/.profile~/.zshenv~/.yaver/bin/current

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/hermesc-runtime.jsView file

24const https = require("https"); L25: const { spawnSync } = require("child_process"); L26:

High

Child Process

Package source references child process execution.

src/hermesc-runtime.jsView on unpkg · L24

23const path = require("path"); L24: const https = require("https"); L25: const { spawnSync } = require("child_process"); L26: L27: const HERMES_RN_VERSION = process.env.YAVER_HERMES_RN_VERSION || "0.81.5"; L28:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/hermesc-runtime.jsView on unpkg · L23

src/analyzer.jsView file

1const fs = require('fs'); L2: const semver = require('semver');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analyzer.jsView on unpkg · L1

src/postinstall.jsView file

122if (typeof process.geteuid !== "function" || process.geteuid() !== 0) { L123: log("linux/arm64 hermesc build needs cmake/ninja/clang/libicu-dev — re-run `npm install -g yaver-cli` as root to provision them, or install manually."); L124: return; ... L130: } L131: execSync("apt-get update -y", { stdio: ["ignore", "ignore", "ignore"] }); L132: execSync(`DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ${required.join(" ")}`, {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/postinstall.jsView on unpkg · L122

10const { ensureHermesc } = require("./hermesc-runtime"); L11: const { execSync } = require("child_process"); L12: const fs = require("fs"); ... L27: function envEnabled(name) { L28: const raw = String(process.env[name] || "").trim().toLowerCase(); L29: return raw === "1" || raw === "true" || raw === "yes"; ... L120: try { L121: if (process.platform !== "linux") return; L122: if (typeof process.geteuid !== "function" || process.geteuid() !== 0) { ... L293: L294: const home = os.homedir(); L295: const rcFiles = [".bashrc", ".zshrc", ".profile"]

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/postinstall.jsView on unpkg · L10

Source & flagged code

7 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "yaver-cli",

3 "version": "1.99.349",

4 "mcpName": "io.github.yaver-io/yaver",

5 "description": "Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime",

6 "bin": {

7 "yaver": "bin/yaver",

8 "yaver-push": "bin/yaver-push",

9 "yaver-mcp": "bin/yaver-mcp",

10 "yaver-cli": "bin/yaver-mcp"

11 },

12 "main": "src/index.js",

13 "scripts": {

14 "postinstall": "node src/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 "preuninstall": "node src/preuninstall.js"

16 },

17 "files": [

18 "bin/",

19 "src/",

20 "hermesc/",

21 "sdk-manifest.json"

22 ],

23 "keywords": [

24 "mcp",

25 "mcp-server",

26 "model-context-protocol",

27 "claude-code",

28 "codex",

29 "ai-agent",

30 "developer-tools",

31 "local-first",

32 "react-native",

33 "testing",

34 "mobile",

src/hermesc-runtime.jsView file

Lines 3-44javascript

3// Runs from `postinstall` on global installs and on-demand from the

4// bundler. Avoids shipping a ~6 MB binary inside the tarball that's

5// only correct for one platform — instead we detect the host and

6// install a matching hermesc at install time.

7//

8// Lookup order (redundant by design; any one succeeding is enough):

9// 1. Cached install under node_modules/yaver-cli/hermesc/<key>/hermesc

10// 2. Per-user cache under ~/.yaver/hermesc/<key>/hermesc

11// 3. Download from the react-native npm tarball and extract just

12// sdks/hermesc/<rn-dir>/hermesc for this platform

src/analyzer.jsView file

Lines 1-21javascript

1const fs = require('fs');

2const semver = require('semver');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analyzer.jsView on unpkg · L1

3

4

src/postinstall.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2// npm postinstall hook — prefetch the Yaver agent and provision the

3// Yaver-managed Hermes reload stack on global installs so a fresh

4// Linux/WSL/macOS box can get to headless auth + Open in Yaver

5// without an extra `yaver install mobile` step.

6//

7// Must NEVER fail npm install. This is best-effort bootstrap only.

8

9const { ensureAgentBinary, runAgentCommand } =

Lines 102-142javascript

102 try {

103 await runAgentCommand(["mcp", "setup", target.client], { quiet: true });

104 configured.push(target.label);

105 } catch (error) {

106 log(`Skipping MCP setup for ${target.label}: ${error.message}`);

107 }

108 }

109 if (configured.length > 0) {

110 log(`Registered Yaver MCP in: ${configured.join(", ")}.`);

111 }

112}

113

114// ensureLinuxHermescBuildDeps installs the apt packages required to

115// compile hermesc from facebook/hermes sources on linux/arm64 (no

116// upstream prebuilt exists for that arch). Best-effort; only runs as

117// root. Mirrors ci/remote/install-hermesc.sh's dep list so the

118// outcome matches the Hetzner test-box bootstrap path.

119function ensureLinuxHermescBuildDeps() {

120 try {

121 if (process.platform !== "linux") return;

122 if (typeof process.geteuid !== "function" || process.geteuid() !== 0) {

123 log("linux/arm64 hermesc build needs cmake/ninja/clang/libicu-dev — re-run `npm install -g yaver-cli` as root to provision them, or install manually.");

124 return;

125 }

126 const required = ["git", "cmake", "ninja-build", "clang", "python3", "build-essential", "ca-certificates", "libicu-dev", "zlib1g-dev"];

127 if (!commandExists("apt-get")) {

128 log(`hermesc build deps missing (${required.join(", ")}) and no apt-get available. Install manually then re-run \`yaver install mobile\`.`);

129 return;

130 }

131 execSync("apt-get update -y", { stdio: ["ignore", "ignore", "ignore"] });

132 execSync(`DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ${required.join(" ")}`, {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/postinstall.jsView on unpkg · L122

133 stdio: "inherit",

134 });

135 log("Installed Linux hermesc build deps (cmake/ninja/clang/libicu-dev).");

136 } catch (error) {

137 log(`Skipping hermesc build deps install: ${error.message}`);

138 }

139}

140

141function ensureLinuxRunnerSandboxPackages() {

142 try {