Loading npm security reports…

yaver-cli@1.99.350: AI-agent policy block | LPM Firewall

registry / yaver-cli / 1.99.350

yaver-cli@1.99.350

Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. A global npm install automatically installs third-party AI runners and registers Yaver MCP integrations without user confirmation. It also downloads and executes an external agent binary, and can alter host sandbox settings when root.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm global install of yaver-cli, unless opt-out environment variables are set

Impact

Unconsented mutation of broad AI-agent control surfaces and host configuration

Mechanism

postinstall bootstrap installs AI clients, executes remote binary, and configures MCP

Policy narrative

On global installation, postinstall downloads and executes a Yaver release binary, installs missing Claude Code, Codex, and OpenCode globally, then asks that binary to register Yaver MCP with each detected client. This occurs without an interactive consent step. Under root it can also install system packages and relax Linux user-namespace/AppArmor settings.

Rationale

Source inspection confirms an unconsented postinstall mutation of foreign, broad AI-agent control surfaces, which meets the blocking policy. The lifecycle hook additionally performs remote binary execution and privileged host configuration.

Evidence

package.jsonsrc/postinstall.jssrc/agent-runtime.jssrc/preuninstall.js~/.bashrc~/.zshrc~/.profile~/.zshenv/etc/sysctl.d/99-yaver-runner-sandbox.conf

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/hermesc-runtime.jsView file

24const https = require("https"); L25: const { spawnSync } = require("child_process"); L26:

High

Child Process

Package source references child process execution.

src/hermesc-runtime.jsView on unpkg · L24

23const path = require("path"); L24: const https = require("https"); L25: const { spawnSync } = require("child_process"); L26: L27: const HERMES_RN_VERSION = process.env.YAVER_HERMES_RN_VERSION || "0.81.5"; L28:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/hermesc-runtime.jsView on unpkg · L23

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.349 matchedPath = src/hermesc-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.349 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/hermesc-runtime.jsView on unpkg

src/analyzer.jsView file

1const fs = require('fs'); L2: const semver = require('semver');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analyzer.jsView on unpkg · L1

src/postinstall.jsView file

122if (typeof process.geteuid !== "function" || process.geteuid() !== 0) { L123: log("linux/arm64 hermesc build needs cmake/ninja/clang/libicu-dev — re-run `npm install -g yaver-cli` as root to provision them, or install manually."); L124: return; ... L130: } L131: execSync("apt-get update -y", { stdio: ["ignore", "ignore", "ignore"] }); L132: execSync(`DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ${required.join(" ")}`, {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/postinstall.jsView on unpkg · L122

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.349 matchedPath = src/postinstall.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.349 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/postinstall.jsView on unpkg

10const { ensureHermesc } = require("./hermesc-runtime"); L11: const { execSync } = require("child_process"); L12: const fs = require("fs"); ... L27: function envEnabled(name) { L28: const raw = String(process.env[name] || "").trim().toLowerCase(); L29: return raw === "1" || raw === "true" || raw === "yes"; ... L120: try { L121: if (process.platform !== "linux") return; L122: if (typeof process.geteuid !== "function" || process.geteuid() !== 0) { ... L293: L294: const home = os.homedir(); L295: const rcFiles = [".bashrc", ".zshrc", ".profile"]

Medium

src/agent-runtime.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.349 matchedPath = src/agent-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.349 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent-runtime.jsView on unpkg

src/commands/run.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.349 matchedPath = src/commands/run.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.349 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/run.jsView on unpkg

src/update-check.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.349 matchedPath = src/update-check.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.349 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/update-check.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "yaver-cli",

3 "version": "1.99.350",

4 "mcpName": "io.github.yaver-io/yaver",

5 "description": "Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime",

6 "bin": {

7 "yaver": "bin/yaver",

8 "yaver-push": "bin/yaver-push",

9 "yaver-mcp": "bin/yaver-mcp",

10 "yaver-cli": "bin/yaver-mcp"

11 },

12 "main": "src/index.js",

13 "scripts": {

14 "postinstall": "node src/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 "preuninstall": "node src/preuninstall.js"

16 },

17 "files": [

18 "bin/",

19 "src/",

20 "hermesc/",

21 "sdk-manifest.json"

22 ],

23 "keywords": [

24 "mcp",

25 "mcp-server",

26 "model-context-protocol",

27 "claude-code",

28 "codex",

29 "ai-agent",

30 "developer-tools",

31 "local-first",

32 "react-native",

33 "testing",

34 "mobile",

src/hermesc-runtime.jsView file

Lines 3-44javascript

3// Runs from `postinstall` on global installs and on-demand from the

4// bundler. Avoids shipping a ~6 MB binary inside the tarball that's

5// only correct for one platform — instead we detect the host and

6// install a matching hermesc at install time.

7//

8// Lookup order (redundant by design; any one succeeding is enough):

9// 1. Cached install under node_modules/yaver-cli/hermesc/<key>/hermesc

10// 2. Per-user cache under ~/.yaver/hermesc/<key>/hermesc

11// 3. Download from the react-native npm tarball and extract just

12// sdks/hermesc/<rn-dir>/hermesc for this platform

src/analyzer.jsView file

Lines 1-21javascript

1const fs = require('fs');

2const semver = require('semver');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analyzer.jsView on unpkg · L1

3

4

src/postinstall.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2// npm postinstall hook — prefetch the Yaver agent and provision the

3// Yaver-managed Hermes reload stack on global installs so a fresh

4// Linux/WSL/macOS box can get to headless auth + Open in Yaver

5// without an extra `yaver install mobile` step.

6//

7// Must NEVER fail npm install. This is best-effort bootstrap only.

8

9const { ensureAgentBinary, runAgentCommand } =

src/agent-runtime.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.349 matchedPath = src/agent-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.349 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent-runtime.jsView on unpkg

src/commands/run.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.349 matchedPath = src/commands/run.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.349 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/run.jsView on unpkg

src/update-check.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.349 matchedPath = src/update-check.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.349 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/update-check.jsView on unpkg

Lines 102-142javascript

102 try {

103 await runAgentCommand(["mcp", "setup", target.client], { quiet: true });

104 configured.push(target.label);

105 } catch (error) {

106 log(`Skipping MCP setup for ${target.label}: ${error.message}`);

107 }

108 }

109 if (configured.length > 0) {

110 log(`Registered Yaver MCP in: ${configured.join(", ")}.`);

111 }

112}

113

114// ensureLinuxHermescBuildDeps installs the apt packages required to

115// compile hermesc from facebook/hermes sources on linux/arm64 (no

116// upstream prebuilt exists for that arch). Best-effort; only runs as

117// root. Mirrors ci/remote/install-hermesc.sh's dep list so the

118// outcome matches the Hetzner test-box bootstrap path.

119function ensureLinuxHermescBuildDeps() {

120 try {

121 if (process.platform !== "linux") return;

122 if (typeof process.geteuid !== "function" || process.geteuid() !== 0) {

123 log("linux/arm64 hermesc build needs cmake/ninja/clang/libicu-dev — re-run `npm install -g yaver-cli` as root to provision them, or install manually.");

124 return;

125 }

126 const required = ["git", "cmake", "ninja-build", "clang", "python3", "build-essential", "ca-certificates", "libicu-dev", "zlib1g-dev"];

127 if (!commandExists("apt-get")) {

128 log(`hermesc build deps missing (${required.join(", ")}) and no apt-get available. Install manually then re-run \`yaver install mobile\`.`);

129 return;

130 }

131 execSync("apt-get update -y", { stdio: ["ignore", "ignore", "ignore"] });

132 execSync(`DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ${required.join(" ")}`, {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/postinstall.jsView on unpkg · L122

133 stdio: "inherit",

134 });

135 log("Installed Linux hermesc build deps (cmake/ninja/clang/libicu-dev).");

136 } catch (error) {

137 log(`Skipping hermesc build deps install: ${error.message}`);

138 }

139}

140

141function ensureLinuxRunnerSandboxPackages() {

142 try {