Loading npm security reports…

yaver-cli@1.99.411: AI-agent control-surface risk | LPM Firewall

registry / yaver-cli / 1.99.411

yaver-cli@1.99.411

Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Global npm installation automatically provisions foreign AI coding runners and registers Yaver MCP with them. It also fetches and executes a remotely selected agent binary, then modifies host configuration.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm install -g yaver-cli

Impact

Unconsented AI-agent control-surface modification and execution of an unverified remote payload.

Mechanism

postinstall runner installation, MCP registration, remote binary execution, and host mutation

Policy narrative

On global installation, the postinstall hook downloads a Yaver release binary selected from GitHub metadata and executes it for provisioning. It installs missing Claude Code, Codex, and OpenCode CLIs globally, then invokes the downloaded agent to register Yaver MCP in each detected runner. The hook also changes shell startup files and, when root, installs packages and changes kernel user-namespace settings. These actions occur without an explicit user command or integrity validation of the downloaded agent.

Rationale

This is concrete unconsented postinstall mutation of foreign AI-agent control surfaces, compounded by unauthenticated remote binary execution and host configuration changes.

Evidence

package.jsonsrc/postinstall.jssrc/agent-runtime.jssrc/preuninstall.js~/.yaver/bin~/.bashrc~/.zshrc~/.profile~/.zshenv/etc/sysctl.d/99-yaver-runner-sandbox.conf

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

3scripts.postinstall = node src/postinstall.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L3: const path = require('path'); L4: const { spawn, spawnSync } = require('child_process'); L5: const { pipeline } = require('stream/promises'); L6: const https = require('https'); L7: const semver = require('semver'); ... L21: // Magic bytes for executable formats. Used to sanity-check a downloaded L22: // binary before we spawn it — an HTML error page or a half-written file L23: // will fail this and we'll redownload instead of producing SIGKILL. ... L48: // 2. A new release publishes its tag but skips the platform L49: // asset (e.g. macOS notarize fails); falling back to a L50: //

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L3

•scripts.postinstall = node src/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/hermesc-runtime.jsView file

24const https = require("https"); L25: const { spawnSync } = require("child_process"); L26:

High

Child Process

Package source references child process execution.

src/hermesc-runtime.jsView on unpkg · L24

23const path = require("path"); L24: const https = require("https"); L25: const { spawnSync } = require("child_process"); L26: L27: const HERMES_RN_VERSION = process.env.YAVER_HERMES_RN_VERSION || "0.81.5"; L28:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/hermesc-runtime.jsView on unpkg · L23

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.409 matchedPath = src/hermesc-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.409 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/hermesc-runtime.jsView on unpkg

src/analyzer.jsView file

1const fs = require('fs'); L2: const semver = require('semver');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analyzer.jsView on unpkg · L1

src/postinstall.jsView file

10Trigger-reachable persistence chain: scripts.postinstall -> src/postinstall.js L10: const { ensureHermesc } = require("./hermesc-runtime"); L11: const { execSync } = require("child_process"); L12: const fs = require("fs"); ... L27: function envEnabled(name) { L28: const raw = String(process.env[name] || "").trim().toLowerCase(); L29: return raw === "1" || raw === "true" || raw === "yes"; ... L120: try { L121: if (process.platform !== "linux") return; L122: if (typeof process.geteuid !== "function" || process.geteuid() !== 0) { ... L293: L294: const home = os.homedir(); L295: const rcFiles = [".bashrc", ".zshrc", ".profile"]

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/postinstall.jsView on unpkg · L10

122if (typeof process.geteuid !== "function" || process.geteuid() !== 0) { L123: log("linux/arm64 hermesc build needs cmake/ninja/clang/libicu-dev — re-run `npm install -g yaver-cli` as root to provision them, or install manually."); L124: return; ... L130: } L131: execSync("apt-get update -y", { stdio: ["ignore", "ignore", "ignore"] }); L132: execSync(`DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ${required.join(" ")}`, {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/postinstall.jsView on unpkg · L122

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.409 matchedPath = src/postinstall.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.409 similarity = 1.000 summary = normalized source hash matched finalized malicious source

hermesc/darwin-x64/hermescView file

•path = hermesc/darwin-x64/hermesc kind = native_binary sizeBytes = 6297624 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

hermesc/darwin-x64/hermescView on unpkg

src/agent-runtime.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.409 matchedPath = src/agent-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.409 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent-runtime.jsView on unpkg

src/commands/run.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.409 matchedPath = src/commands/run.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.409 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/run.jsView on unpkg

src/update-check.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.409 matchedPath = src/update-check.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.409 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/update-check.jsView on unpkg

Source & flagged code

15 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "yaver-cli",

3 "version": "1.99.411",

4 "mcpName": "io.github.yaver-io/yaver",

5 "description": "Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime",

6 "bin": {

7 "yaver": "bin/yaver",

8 "yaver-push": "bin/yaver-push",

9 "yaver-mcp": "bin/yaver-mcp",

10 "yaver-cli": "bin/yaver-mcp"

11 },

12 "main": "src/index.js",

13 "scripts": {

14 "postinstall": "node src/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 "preuninstall": "node src/preuninstall.js"

16 },

17 "files": [

18 "bin/",

19 "src/",

20 "hermesc/",

21 "sdk-manifest.json"

22 ],

23 "keywords": [

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L3

24 "mcp",

25 "mcp-server",

26 "model-context-protocol",

27 "claude-code",

28 "codex",

29 "ai-agent",

30 "developer-tools",

31 "local-first",

32 "react-native",

33 "testing",

34 "mobile",

src/hermesc-runtime.jsView file

Lines 3-44javascript

3// Runs from `postinstall` on global installs and on-demand from the

4// bundler. Avoids shipping a ~6 MB binary inside the tarball that's

5// only correct for one platform — instead we detect the host and

6// install a matching hermesc at install time.

7//

8// Lookup order (redundant by design; any one succeeding is enough):

9// 1. Cached install under node_modules/yaver-cli/hermesc/<key>/hermesc

10// 2. Per-user cache under ~/.yaver/hermesc/<key>/hermesc

11// 3. Download from the react-native npm tarball and extract just

12// sdks/hermesc/<rn-dir>/hermesc for this platform

src/analyzer.jsView file

Lines 1-21javascript

1const fs = require('fs');

2const semver = require('semver');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analyzer.jsView on unpkg · L1

3

4

src/postinstall.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2// npm postinstall hook — prefetch the Yaver agent and provision the

3// Yaver-managed Hermes reload stack on global installs so a fresh

4// Linux/WSL/macOS box can get to headless auth + Open in Yaver

5// without an extra `yaver install mobile` step.

6//

7// Must NEVER fail npm install. This is best-effort bootstrap only.

8

9const { ensureAgentBinary, runAgentCommand } =

hermesc/darwin-x64/hermescView file

•path = hermesc/darwin-x64/hermesc kind = native_binary sizeBytes = 6297624 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

hermesc/darwin-x64/hermescView on unpkg

src/agent-runtime.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.409 matchedPath = src/agent-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.409 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent-runtime.jsView on unpkg

src/commands/run.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.409 matchedPath = src/commands/run.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.409 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/run.jsView on unpkg

src/update-check.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.409 matchedPath = src/update-check.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.409 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/update-check.jsView on unpkg