Loading npm security reports…

yaver-cli@1.99.435: AI-agent control-surface risk | LPM Firewall

registry / yaver-cli / 1.99.435

yaver-cli@1.99.435

Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically downloads and executes a native agent, registers it in third-party AI coding clients, and modifies host configuration. Root installs also alter kernel sandbox configuration.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing yaver-cli globally without the postinstall opt-out environment variables.

Impact

The package can add an agent-controlled MCP integration to Codex, Claude Code, and OpenCode and change system settings without an explicit setup command.

Mechanism

Postinstall bootstrap of a remote agent and foreign MCP client configuration.

Policy narrative

On global installation, the lifecycle hook fetches a native Yaver agent, restarts its service, and invokes that agent to register MCP integrations in existing Claude Code, Codex, and OpenCode installations. This modifies foreign AI-agent control surfaces without an explicit user setup command. Under root on Linux it also writes a sysctl configuration and applies it immediately.

Rationale

This is an automatic postinstall chain that executes a remotely fetched binary and mutates third-party AI-agent configuration. Its global-install gate and opt-out variables do not establish consent for those changes.

Evidence

package.jsonsrc/postinstall.jssrc/agent-runtime.js~/.yaver/bin/current/etc/sysctl.d/99-yaver-runner-sandbox.conf

Network endpoints

Source & flagged code

23 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node src/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/hermesc-runtime.jsView file

24const https = require("https"); L25: const { spawnSync } = require("child_process"); L26:

High

Child Process

Package source references child process execution.

src/hermesc-runtime.jsView on unpkg · L24

23const path = require("path"); L24: const https = require("https"); L25: const { spawnSync } = require("child_process"); L26: L27: const HERMES_RN_VERSION = process.env.YAVER_HERMES_RN_VERSION || "0.81.5"; L28:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/hermesc-runtime.jsView on unpkg · L23

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.434 matchedPath = src/hermesc-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.434 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/hermesc-runtime.jsView on unpkg

src/postinstall.jsView file

554// runners are ordinary npm globals and must not disappear merely because L555: // the install came from PowerShell. L556: if (!envEnabled("YAVER_SKIP_POSTINSTALL_RUNNERS")) {

High

Shell

Package source references shell execution.

src/postinstall.jsView on unpkg · L554

10Trigger-reachable persistence chain: scripts.postinstall -> src/postinstall.js L10: const { ensureHermesc } = require("./hermesc-runtime"); L11: const { execFileSync, execSync, spawnSync } = require("child_process"); L12: const fs = require("fs"); ... L29: function envEnabled(name) { L30: const raw = String(process.env[name] || "").trim().toLowerCase(); L31: return raw === "1" || raw === "true" || raw === "yes"; ... L49: function commandExists(name) { L50: const probe = process.platform === "win32" L51: ? spawnSync("where.exe", [name], { stdio: "ignore", windowsHide: true }) L52: : spawnSync("/bin/sh", ["-c", `command -v ${name}`], { stdio: "ignore" }); L53: return !probe.error && probe.status === 0; ... L321:

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/postinstall.jsView on unpkg · L10

150if (typeof process.geteuid !== "function" || process.geteuid() !== 0) { L151: log("linux/arm64 hermesc build needs cmake/ninja/clang/libicu-dev — re-run `npm install -g yaver-cli` as root to provision them, or install manually."); L152: return; ... L158: } L159: execSync("apt-get update -y", { stdio: ["ignore", "ignore", "ignore"] }); L160: execSync(`DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ${required.join(" ")}`, {

High

src/analyzer.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.434 matchedPath = src/analyzer.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.434 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/analyzer.jsView on unpkg

1const fs = require('fs'); L2: const semver = require('semver');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analyzer.jsView on unpkg · L1

src/commands/desktop.jsView file

15const fs = require("node:fs"); L16: const https = require("node:https"); L17: const os = require("node:os"); L18: const path = require("node:path"); L19: const { spawn, spawnSync } = require("node:child_process"); L20: const { pipeline } = require("node:stream/promises"); ... L50: L51: function normalizedArch(arch = process.arch) { L52: if (arch === "x64" || arch === "amd64") return "x64"; ... L95: L96: function installedDesktopCandidates(platform = process.platform, env = process.env, home = os.homedir()) { L97: if (platform === "darwin") {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/commands/desktop.jsView on unpkg · L15

15Trigger-reachable chain: scripts.postinstall -> src/postinstall.js -> src/commands/desktop.js L15: const fs = require("node:fs"); L16: const https = require("node:https"); L17: const os = require("node:os"); L18: const path = require("node:path"); L19: const { spawn, spawnSync } = require("node:child_process"); L20: const { pipeline } = require("node:stream/promises"); ... L50: L51: function normalizedArch(arch = process.arch) { L52: if (arch === "x64" || arch === "amd64") return "x64"; ... L95: L96: function installedDesktopCandidates(platform = process.platform, env = process.env, home = os.homedir()) { L97: if (platform === "darwin") {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/commands/desktop.jsView on unpkg · L15

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.434 matchedPath = src/commands/desktop.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.434 similarity = 1.000 summary = normalized source hash matched finalized malicious source

hermesc/darwin-x64/hermescView file

•path = hermesc/darwin-x64/hermesc kind = native_binary sizeBytes = 6297624 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

hermesc/darwin-x64/hermescView on unpkg

src/agent-runtime.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = yaver-cli@1.99.332 matchedIdentity = npm:eWF2ZXItY2xp:1.99.332 similarity = 0.857 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/agent-runtime.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.434 matchedPath = src/agent-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.434 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent-runtime.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = b886796cd40a3435 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = yaver-cli@1.99.434 matchedPath = src/agent-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.434 similarity = 1.000 shingleOverlap = 25 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/agent-runtime.jsView on unpkg

src/commands/run.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.434 matchedPath = src/commands/run.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.434 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/run.jsView on unpkg

src/update-check.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.434 matchedPath = src/update-check.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.434 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/update-check.jsView on unpkg

src/transport.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.434 matchedPath = src/transport.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.434 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/transport.jsView on unpkg