registry / yaver-cli / 1.99.468

yaver-cli@1.99.468

⚠ Under review

Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 31 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 23 file(s), 191 KB of source, external domains: api.github.com, github.com, registry.npmjs.org, unpkg.com

Source & flagged code

23 flagged

package.jsonView file

Lines 1-35json

2 "name": "yaver-cli",

3 "version": "1.99.468",

4 "mcpName": "io.github.yaver-io/yaver",

5 "description": "Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime",

6 "bin": {

7 "yaver": "bin/yaver",

8 "yaver-push": "bin/yaver-push",

9 "yaver-mcp": "bin/yaver-mcp",

10 "yaver-cli": "bin/yaver-mcp"

11 },

12 "main": "src/index.js",

13 "scripts": {

14 "test": "node --test test/*.test.js",

15 "postinstall": "node src/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L15

16 "preuninstall": "node src/preuninstall.js"

17 },

18 "files": [

19 "bin/",

20 "src/",

21 "hermesc/",

22 "sdk-manifest.json"

23 ],

24 "keywords": [

25 "mcp",

26 "mcp-server",

27 "model-context-protocol",

28 "claude-code",

29 "codex",

30 "ai-agent",

31 "developer-tools",

32 "local-first",

33 "react-native",

34 "testing",

35 "mobile",

src/hermesc-runtime.jsView file

Lines 3-44javascript

3// Runs from `postinstall` on global installs and on-demand from the

4// bundler. Avoids shipping a ~6 MB binary inside the tarball that's

5// only correct for one platform — instead we detect the host and

6// install a matching hermesc at install time.

7//

8// Lookup order (redundant by design; any one succeeding is enough):

9// 1. Cached install under node_modules/yaver-cli/hermesc/<key>/hermesc

10// 2. Per-user cache under ~/.yaver/hermesc/<key>/hermesc

11// 3. Download from the react-native npm tarball and extract just

12// sdks/hermesc/<rn-dir>/hermesc for this platform

src/postinstall.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2// npm postinstall hook — prefetch the Yaver agent and provision the

3// Yaver-managed Hermes reload stack on global installs so a fresh

4// Linux/WSL/macOS box can get to headless auth + Open in Yaver

5// without an extra `yaver install mobile` step.

6//

7// Must NEVER fail npm install. This is best-effort bootstrap only.

9const { ensureAgentBinary, runAgentCommand } =

src/analyzer.jsView file

Lines 1-21javascript

1const fs = require('fs');

2const semver = require('semver');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analyzer.jsView on unpkg · L1

src/commands/desktop.jsView file

Lines 1-35javascript

1"use strict";

3/**

4 * Optional native desktop companion for the unified npm CLI.

5 *

6 * The npm package intentionally does not contain Electron itself. `yaver

7 * desktop install` downloads the architecture-specific canonical `electron/`

8 * release, verifies the release checksum, verifies the OS signature where the

9 * host provides one, and installs per-user. The Go agent remains independently

10 * usable through the console and an already-running agent is adopted by the

hermesc/darwin-x64/hermescView file

•path = hermesc/darwin-x64/hermesc kind = native_binary sizeBytes = 6297624 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

hermesc/darwin-x64/hermescView on unpkg

src/agent-runtime.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/agent-runtime.js#virtual:normalized:round1View on unpkg

src/agent-runtime.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = yaver-cli@1.99.332 matchedIdentity = npm:eWF2ZXItY2xp:1.99.332 similarity = 0.810 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/agent-runtime.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.467 matchedPath = src/agent-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.467 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent-runtime.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5833c22bf5432ec3 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = yaver-cli@1.99.467 matchedPath = src/agent-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.467 similarity = 1.000 shingleOverlap = 25 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/agent-runtime.jsView on unpkg

src/commands/run.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.424 matchedPath = src/commands/run.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.424 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/run.jsView on unpkg

src/update-check.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.424 matchedPath = src/update-check.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.424 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/update-check.jsView on unpkg

src/transport.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.424 matchedPath = src/transport.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.424 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/transport.jsView on unpkg

Source & flagged code

23 flagged · loading source

package.jsonView file

yaver-cli@1.99.468

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code