Loading npm security reports…

yaver-cli@1.99.425: AI-agent control-surface risk | LPM Firewall

registry / yaver-cli / 1.99.425

yaver-cli@1.99.425

Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm postinstall alters third-party AI coding-client configuration and may install those clients. It also changes host kernel settings, downloads an executable agent, and restarts Yaver services.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install -g yaver-cli

Impact

Codex, Claude Code, or OpenCode can receive a Yaver MCP registration; the installer can also alter kernel policy and execute a remotely fetched agent.

Mechanism

Unconsented lifecycle bootstrap of AI-agent integrations and host configuration

Policy narrative

On a global installation, the package lifecycle hook automatically bootstraps coding runners and invokes a downloaded Yaver agent to register its MCP server with existing Claude Code, Codex, and OpenCode installations. It additionally changes Linux user-namespace and AppArmor-related kernel settings, adjusts shell startup files, and restarts Yaver services. These actions occur without an explicit setup command and affect foreign AI-agent control surfaces.

Rationale

The package performs unconsented global postinstall mutation of third-party AI-agent integrations, meeting the blocking control-surface policy. Additional host security changes and unchecked remote-agent execution increase impact.

Evidence

package.jsonsrc/postinstall.jssrc/agent-runtime.jssrc/preuninstall.js/etc/sysctl.d/99-yaver-runner-sandbox.conf~/.yaver/bin~/.bashrc~/.zshrc~/.profile

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/hermesc-runtime.jsView file

24const https = require("https"); L25: const { spawnSync } = require("child_process"); L26:

High

Child Process

Package source references child process execution.

src/hermesc-runtime.jsView on unpkg · L24

23const path = require("path"); L24: const https = require("https"); L25: const { spawnSync } = require("child_process"); L26: L27: const HERMES_RN_VERSION = process.env.YAVER_HERMES_RN_VERSION || "0.81.5"; L28:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/hermesc-runtime.jsView on unpkg · L23

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.423 matchedPath = src/hermesc-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.423 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/hermesc-runtime.jsView on unpkg

src/postinstall.jsView file

554// runners are ordinary npm globals and must not disappear merely because L555: // the install came from PowerShell. L556: if (!envEnabled("YAVER_SKIP_POSTINSTALL_RUNNERS")) {

High

Shell

Package source references shell execution.

src/postinstall.jsView on unpkg · L554

10Trigger-reachable persistence chain: scripts.postinstall -> src/postinstall.js L10: const { ensureHermesc } = require("./hermesc-runtime"); L11: const { execFileSync, execSync, spawnSync } = require("child_process"); L12: const fs = require("fs"); ... L29: function envEnabled(name) { L30: const raw = String(process.env[name] || "").trim().toLowerCase(); L31: return raw === "1" || raw === "true" || raw === "yes"; ... L49: function commandExists(name) { L50: const probe = process.platform === "win32" L51: ? spawnSync("where.exe", [name], { stdio: "ignore", windowsHide: true }) L52: : spawnSync("/bin/sh", ["-c", `command -v ${name}`], { stdio: "ignore" }); L53: return !probe.error && probe.status === 0; ... L321:

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/postinstall.jsView on unpkg · L10

150if (typeof process.geteuid !== "function" || process.geteuid() !== 0) { L151: log("linux/arm64 hermesc build needs cmake/ninja/clang/libicu-dev — re-run `npm install -g yaver-cli` as root to provision them, or install manually."); L152: return; ... L158: } L159: execSync("apt-get update -y", { stdio: ["ignore", "ignore", "ignore"] }); L160: execSync(`DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ${required.join(" ")}`, {

High

src/analyzer.jsView file

1const fs = require('fs'); L2: const semver = require('semver');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analyzer.jsView on unpkg · L1

src/commands/desktop.jsView file

15const fs = require("node:fs"); L16: const https = require("node:https"); L17: const os = require("node:os"); L18: const path = require("node:path"); L19: const { spawn, spawnSync } = require("node:child_process"); L20: const { pipeline } = require("node:stream/promises"); ... L50: L51: function normalizedArch(arch = process.arch) { L52: if (arch === "x64" || arch === "amd64") return "x64"; ... L95: L96: function installedDesktopCandidates(platform = process.platform, env = process.env, home = os.homedir()) { L97: if (platform === "darwin") {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/commands/desktop.jsView on unpkg · L15

15Trigger-reachable chain: scripts.postinstall -> src/postinstall.js -> src/commands/desktop.js L15: const fs = require("node:fs"); L16: const https = require("node:https"); L17: const os = require("node:os"); L18: const path = require("node:path"); L19: const { spawn, spawnSync } = require("node:child_process"); L20: const { pipeline } = require("node:stream/promises"); ... L50: L51: function normalizedArch(arch = process.arch) { L52: if (arch === "x64" || arch === "amd64") return "x64"; ... L95: L96: function installedDesktopCandidates(platform = process.platform, env = process.env, home = os.homedir()) { L97: if (platform === "darwin") {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/commands/desktop.jsView on unpkg · L15

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.423 matchedPath = src/commands/desktop.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.423 similarity = 1.000 summary = normalized source hash matched finalized malicious source

hermesc/darwin-x64/hermescView file

•path = hermesc/darwin-x64/hermesc kind = native_binary sizeBytes = 6297624 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

hermesc/darwin-x64/hermescView on unpkg

src/agent-runtime.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.423 matchedPath = src/agent-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.423 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent-runtime.jsView on unpkg

src/commands/run.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.423 matchedPath = src/commands/run.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.423 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/run.jsView on unpkg

Source & flagged code

17 flagged

package.jsonView file

Lines 1-35json

1{

2 "name": "yaver-cli",

3 "version": "1.99.425",

4 "mcpName": "io.github.yaver-io/yaver",

5 "description": "Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime",

6 "bin": {

7 "yaver": "bin/yaver",

8 "yaver-push": "bin/yaver-push",

9 "yaver-mcp": "bin/yaver-mcp",

10 "yaver-cli": "bin/yaver-mcp"

11 },

12 "main": "src/index.js",

13 "scripts": {

14 "test": "node --test test/*.test.js",

15 "postinstall": "node src/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L15

16 "preuninstall": "node src/preuninstall.js"

17 },

18 "files": [

19 "bin/",

20 "src/",

21 "hermesc/",

22 "sdk-manifest.json"

23 ],

24 "keywords": [

25 "mcp",

26 "mcp-server",

27 "model-context-protocol",

28 "claude-code",

29 "codex",

30 "ai-agent",

31 "developer-tools",

32 "local-first",

33 "react-native",

34 "testing",

35 "mobile",

src/hermesc-runtime.jsView file

Lines 3-44javascript

3// Runs from `postinstall` on global installs and on-demand from the

4// bundler. Avoids shipping a ~6 MB binary inside the tarball that's

5// only correct for one platform — instead we detect the host and

6// install a matching hermesc at install time.

7//

8// Lookup order (redundant by design; any one succeeding is enough):

9// 1. Cached install under node_modules/yaver-cli/hermesc/<key>/hermesc

10// 2. Per-user cache under ~/.yaver/hermesc/<key>/hermesc

11// 3. Download from the react-native npm tarball and extract just

12// sdks/hermesc/<rn-dir>/hermesc for this platform

src/postinstall.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2// npm postinstall hook — prefetch the Yaver agent and provision the

3// Yaver-managed Hermes reload stack on global installs so a fresh

4// Linux/WSL/macOS box can get to headless auth + Open in Yaver

5// without an extra `yaver install mobile` step.

6//

7// Must NEVER fail npm install. This is best-effort bootstrap only.

8

9const { ensureAgentBinary, runAgentCommand } =

src/analyzer.jsView file

Lines 1-21javascript

1const fs = require('fs');

2const semver = require('semver');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analyzer.jsView on unpkg · L1

3

4

src/commands/desktop.jsView file

Lines 1-35javascript

1"use strict";

2

3/**

4 * Optional native desktop companion for the unified npm CLI.

5 *

6 * The npm package intentionally does not contain Electron itself. `yaver

7 * desktop install` downloads the architecture-specific canonical `electron/`

8 * release, verifies the release checksum, verifies the OS signature where the

9 * host provides one, and installs per-user. The Go agent remains independently

10 * usable through the console and an already-running agent is adopted by the

hermesc/darwin-x64/hermescView file

•path = hermesc/darwin-x64/hermesc kind = native_binary sizeBytes = 6297624 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

hermesc/darwin-x64/hermescView on unpkg

src/agent-runtime.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.423 matchedPath = src/agent-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.423 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent-runtime.jsView on unpkg

src/commands/run.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.423 matchedPath = src/commands/run.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.423 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/run.jsView on unpkg