Loading npm security reports…

yaver-cli@1.99.406: AI-agent control-surface risk | LPM Firewall

registry / yaver-cli / 1.99.406

yaver-cli@1.99.406

Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime

AI Security Review

scanned 6d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically installs third-party AI runners and registers Yaver as an MCP server in them. It downloads an unpinned executable and runs it during installation.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm global install of yaver-cli

Impact

Unconsented modification of Claude Code, Codex, and OpenCode control surfaces; arbitrary release-selected native code executes.

Mechanism

postinstall provisioning and foreign AI-agent MCP configuration

Policy narrative

On global installation, postinstall fetches a Yaver release binary, executes it to configure Yaver MCP integrations in installed Claude Code, Codex, and OpenCode clients, and may first install those clients globally. The downloaded executable is selected from remote GitHub release metadata without a pinned checksum/signature. The same hook also mutates shell startup files, restarts services, and can change Linux sandbox settings as root.

Rationale

This is an unconsented npm postinstall mutation of multiple foreign AI-agent control surfaces, compounded by remote native payload execution. The global-install guard and opt-outs do not establish prior consent.

Evidence

package.jsonsrc/postinstall.jssrc/agent-runtime.jssrc/hermesc-runtime.js~/.bashrc~/.zshrc~/.profile~/.zshenv~/.yaver/bin/etc/sysctl.d/99-yaver-runner-sandbox.conf

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

3scripts.postinstall = node src/postinstall.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L3: const path = require('path'); L4: const { spawn, spawnSync } = require('child_process'); L5: const { pipeline } = require('stream/promises'); L6: const https = require('https'); L7: const semver = require('semver'); ... L21: // Magic bytes for executable formats. Used to sanity-check a downloaded L22: // binary before we spawn it — an HTML error page or a half-written file L23: // will fail this and we'll redownload instead of producing SIGKILL. ... L48: // 2. A new release publishes its tag but skips the platform L49: // asset (e.g. macOS notarize fails); falling back to a L50: //

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L3

•scripts.postinstall = node src/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/hermesc-runtime.jsView file

24const https = require("https"); L25: const { spawnSync } = require("child_process"); L26:

High

Child Process

Package source references child process execution.

src/hermesc-runtime.jsView on unpkg · L24

23const path = require("path"); L24: const https = require("https"); L25: const { spawnSync } = require("child_process"); L26: L27: const HERMES_RN_VERSION = process.env.YAVER_HERMES_RN_VERSION || "0.81.5"; L28:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/hermesc-runtime.jsView on unpkg · L23

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.391 matchedPath = src/hermesc-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.391 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/hermesc-runtime.jsView on unpkg

src/analyzer.jsView file

1const fs = require('fs'); L2: const semver = require('semver');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analyzer.jsView on unpkg · L1

src/postinstall.jsView file

10Trigger-reachable persistence chain: scripts.postinstall -> src/postinstall.js L10: const { ensureHermesc } = require("./hermesc-runtime"); L11: const { execSync } = require("child_process"); L12: const fs = require("fs"); ... L27: function envEnabled(name) { L28: const raw = String(process.env[name] || "").trim().toLowerCase(); L29: return raw === "1" || raw === "true" || raw === "yes"; ... L120: try { L121: if (process.platform !== "linux") return; L122: if (typeof process.geteuid !== "function" || process.geteuid() !== 0) { ... L293: L294: const home = os.homedir(); L295: const rcFiles = [".bashrc", ".zshrc", ".profile"]

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/postinstall.jsView on unpkg · L10

122if (typeof process.geteuid !== "function" || process.geteuid() !== 0) { L123: log("linux/arm64 hermesc build needs cmake/ninja/clang/libicu-dev — re-run `npm install -g yaver-cli` as root to provision them, or install manually."); L124: return; ... L130: } L131: execSync("apt-get update -y", { stdio: ["ignore", "ignore", "ignore"] }); L132: execSync(`DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ${required.join(" ")}`, {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/postinstall.jsView on unpkg · L122

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.391 matchedPath = src/postinstall.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.391 similarity = 1.000 summary = normalized source hash matched finalized malicious source

src/agent-runtime.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.391 matchedPath = src/agent-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.391 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent-runtime.jsView on unpkg

src/commands/run.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.391 matchedPath = src/commands/run.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.391 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/run.jsView on unpkg

src/update-check.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.391 matchedPath = src/update-check.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.391 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/update-check.jsView on unpkg

Source & flagged code

14 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "yaver-cli",

3 "version": "1.99.406",

4 "mcpName": "io.github.yaver-io/yaver",

5 "description": "Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime",

6 "bin": {

7 "yaver": "bin/yaver",

8 "yaver-push": "bin/yaver-push",

9 "yaver-mcp": "bin/yaver-mcp",

10 "yaver-cli": "bin/yaver-mcp"

11 },

12 "main": "src/index.js",

13 "scripts": {

14 "postinstall": "node src/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 "preuninstall": "node src/preuninstall.js"

16 },

17 "files": [

18 "bin/",

19 "src/",

20 "hermesc/",

21 "sdk-manifest.json"

22 ],

23 "keywords": [

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L3

24 "mcp",

25 "mcp-server",

26 "model-context-protocol",

27 "claude-code",

28 "codex",

29 "ai-agent",

30 "developer-tools",

31 "local-first",

32 "react-native",

33 "testing",

34 "mobile",

src/hermesc-runtime.jsView file

Lines 3-44javascript

3// Runs from `postinstall` on global installs and on-demand from the

4// bundler. Avoids shipping a ~6 MB binary inside the tarball that's

5// only correct for one platform — instead we detect the host and

6// install a matching hermesc at install time.

7//

8// Lookup order (redundant by design; any one succeeding is enough):

9// 1. Cached install under node_modules/yaver-cli/hermesc/<key>/hermesc

10// 2. Per-user cache under ~/.yaver/hermesc/<key>/hermesc

11// 3. Download from the react-native npm tarball and extract just

12// sdks/hermesc/<rn-dir>/hermesc for this platform

src/analyzer.jsView file

Lines 1-21javascript

1const fs = require('fs');

2const semver = require('semver');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analyzer.jsView on unpkg · L1

3

4

src/postinstall.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2// npm postinstall hook — prefetch the Yaver agent and provision the

3// Yaver-managed Hermes reload stack on global installs so a fresh

4// Linux/WSL/macOS box can get to headless auth + Open in Yaver

5// without an extra `yaver install mobile` step.

6//

7// Must NEVER fail npm install. This is best-effort bootstrap only.

8

9const { ensureAgentBinary, runAgentCommand } =

src/agent-runtime.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.391 matchedPath = src/agent-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.391 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent-runtime.jsView on unpkg

src/commands/run.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.391 matchedPath = src/commands/run.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.391 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/run.jsView on unpkg

src/update-check.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.391 matchedPath = src/update-check.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.391 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/update-check.jsView on unpkg