yaver-cli@1.99.434: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

yaver-cli@1.99.434: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

22 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node src/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/hermesc-runtime.jsView file

24const https = require("https"); L25: const { spawnSync } = require("child_process"); L26:

High

Child Process

Package source references child process execution.

src/hermesc-runtime.jsView on unpkg · L24

23const path = require("path"); L24: const https = require("https"); L25: const { spawnSync } = require("child_process"); L26: L27: const HERMES_RN_VERSION = process.env.YAVER_HERMES_RN_VERSION || "0.81.5"; L28:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/hermesc-runtime.jsView on unpkg · L23

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.426 matchedPath = src/hermesc-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.426 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/hermesc-runtime.jsView on unpkg

src/postinstall.jsView file

554// runners are ordinary npm globals and must not disappear merely because L555: // the install came from PowerShell. L556: if (!envEnabled("YAVER_SKIP_POSTINSTALL_RUNNERS")) {

High

Shell

Package source references shell execution.

src/postinstall.jsView on unpkg · L554

10Trigger-reachable persistence chain: scripts.postinstall -> src/postinstall.js L10: const { ensureHermesc } = require("./hermesc-runtime"); L11: const { execFileSync, execSync, spawnSync } = require("child_process"); L12: const fs = require("fs"); ... L29: function envEnabled(name) { L30: const raw = String(process.env[name] || "").trim().toLowerCase(); L31: return raw === "1" || raw === "true" || raw === "yes"; ... L49: function commandExists(name) { L50: const probe = process.platform === "win32" L51: ? spawnSync("where.exe", [name], { stdio: "ignore", windowsHide: true }) L52: : spawnSync("/bin/sh", ["-c", `command -v ${name}`], { stdio: "ignore" }); L53: return !probe.error && probe.status === 0; ... L321:

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/postinstall.jsView on unpkg · L10

150if (typeof process.geteuid !== "function" || process.geteuid() !== 0) { L151: log("linux/arm64 hermesc build needs cmake/ninja/clang/libicu-dev — re-run `npm install -g yaver-cli` as root to provision them, or install manually."); L152: return; ... L158: } L159: execSync("apt-get update -y", { stdio: ["ignore", "ignore", "ignore"] }); L160: execSync(`DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ${required.join(" ")}`, {

High

src/analyzer.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.426 matchedPath = src/analyzer.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.426 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/analyzer.jsView on unpkg

1const fs = require('fs'); L2: const semver = require('semver');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analyzer.jsView on unpkg · L1

src/commands/desktop.jsView file

15const fs = require("node:fs"); L16: const https = require("node:https"); L17: const os = require("node:os"); L18: const path = require("node:path"); L19: const { spawn, spawnSync } = require("node:child_process"); L20: const { pipeline } = require("node:stream/promises"); ... L50: L51: function normalizedArch(arch = process.arch) { L52: if (arch === "x64" || arch === "amd64") return "x64"; ... L95: L96: function installedDesktopCandidates(platform = process.platform, env = process.env, home = os.homedir()) { L97: if (platform === "darwin") {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/commands/desktop.jsView on unpkg · L15

15Trigger-reachable chain: scripts.postinstall -> src/postinstall.js -> src/commands/desktop.js L15: const fs = require("node:fs"); L16: const https = require("node:https"); L17: const os = require("node:os"); L18: const path = require("node:path"); L19: const { spawn, spawnSync } = require("node:child_process"); L20: const { pipeline } = require("node:stream/promises"); ... L50: L51: function normalizedArch(arch = process.arch) { L52: if (arch === "x64" || arch === "amd64") return "x64"; ... L95: L96: function installedDesktopCandidates(platform = process.platform, env = process.env, home = os.homedir()) { L97: if (platform === "darwin") {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/commands/desktop.jsView on unpkg · L15

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.426 matchedPath = src/commands/desktop.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.426 similarity = 1.000 summary = normalized source hash matched finalized malicious source

hermesc/darwin-x64/hermescView file

•path = hermesc/darwin-x64/hermesc kind = native_binary sizeBytes = 6297624 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

hermesc/darwin-x64/hermescView on unpkg

src/agent-runtime.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = yaver-cli@1.99.332 matchedIdentity = npm:eWF2ZXItY2xp:1.99.332 similarity = 0.857 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/agent-runtime.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.426 matchedPath = src/agent-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.426 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent-runtime.jsView on unpkg

src/commands/run.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.426 matchedPath = src/commands/run.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.426 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/run.jsView on unpkg

src/update-check.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.426 matchedPath = src/update-check.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.426 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/update-check.jsView on unpkg

src/transport.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.426 matchedPath = src/transport.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.426 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/transport.jsView on unpkg