yaver-cli@1.99.477: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

yaver-cli@1.99.477: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/hermesc-runtime.jsView file

24const https = require("https"); L25: const { spawnSync } = require("child_process"); L26:

High

Child Process

Package source references child process execution.

src/hermesc-runtime.jsView on unpkg · L24

23const path = require("path"); L24: const https = require("https"); L25: const { spawnSync } = require("child_process"); L26: L27: const HERMES_RN_VERSION = process.env.YAVER_HERMES_RN_VERSION || "0.81.5"; L28:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/hermesc-runtime.jsView on unpkg · L23

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.474 matchedPath = src/hermesc-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.474 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/hermesc-runtime.jsView on unpkg

src/postinstall.jsView file

590// runners are ordinary npm globals and must not disappear merely because L591: // the install came from PowerShell. L592: if (!envEnabled("YAVER_SKIP_POSTINSTALL_RUNNERS")) {

High

Shell

Package source references shell execution.

src/postinstall.jsView on unpkg · L590

8Trigger-reachable persistence chain: scripts.postinstall -> src/postinstall.js L8: const { ensureHermesc } = require("./hermesc-runtime"); L9: const { execFileSync, execSync, spawn, spawnSync } = require("child_process"); L10: const fs = require("fs"); ... L28: function envEnabled(name) { L29: const raw = String(process.env[name] || "").trim().toLowerCase(); L30: return raw === "1" || raw === "true" || raw === "yes"; ... L48: function commandExists(name) { L49: const probe = process.platform === "win32" L50: ? spawnSync("where.exe", [name], { stdio: "ignore", windowsHide: true }) L51: : spawnSync("/bin/sh", ["-c", `command -v ${name}`], { stdio: "ignore" }); L52: return !probe.error && probe.status === 0; ... L246: async function prepareHeadlessChromiumDogfood() {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/postinstall.jsView on unpkg · L8

128if (typeof process.geteuid !== "function" || process.geteuid() !== 0) { L129: log("linux/arm64 hermesc build needs cmake/ninja/clang/libicu-dev — re-run `npm install -g yaver-cli` as root to provision them, or install manually."); L130: return; ... L136: } L137: execSync("apt-get update -y", { stdio: ["ignore", "ignore", "ignore"] }); L138: execSync(`DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ${required.join(" ")}`, {

src/analyzer.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.474 matchedPath = src/analyzer.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.474 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/analyzer.jsView on unpkg

1const fs = require('fs'); L2: const semver = require('semver');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analyzer.jsView on unpkg · L1

src/commands/desktop.jsView file

15const fs = require("node:fs"); L16: const https = require("node:https"); L17: const os = require("node:os"); L18: const path = require("node:path"); L19: const { spawn, spawnSync } = require("node:child_process"); L20: const { pipeline } = require("node:stream/promises"); ... L50: L51: function normalizedArch(arch = process.arch) { L52: if (arch === "x64" || arch === "amd64") return "x64"; ... L95: L96: function installedDesktopCandidates(platform = process.platform, env = process.env, home = os.homedir()) { L97: if (platform === "darwin") {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/commands/desktop.jsView on unpkg · L15

15Trigger-reachable chain: scripts.postinstall -> src/postinstall.js -> src/commands/desktop.js L15: const fs = require("node:fs"); L16: const https = require("node:https"); L17: const os = require("node:os"); L18: const path = require("node:path"); L19: const { spawn, spawnSync } = require("node:child_process"); L20: const { pipeline } = require("node:stream/promises"); ... L50: L51: function normalizedArch(arch = process.arch) { L52: if (arch === "x64" || arch === "amd64") return "x64"; ... L95: L96: function installedDesktopCandidates(platform = process.platform, env = process.env, home = os.homedir()) { L97: if (platform === "darwin") {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/commands/desktop.jsView on unpkg · L15

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.474 matchedPath = src/commands/desktop.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.474 similarity = 1.000 summary = normalized source hash matched finalized malicious source

hermesc/darwin-x64/hermescView file

•path = hermesc/darwin-x64/hermesc kind = native_binary sizeBytes = 6297624 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

hermesc/darwin-x64/hermescView on unpkg

src/agent-runtime.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/agent-runtime.js#virtual:normalized:round1View on unpkg

src/agent-runtime.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.474 matchedPath = src/agent-runtime.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.474 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agent-runtime.jsView on unpkg

src/commands/run.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.474 matchedPath = src/commands/run.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.474 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/run.jsView on unpkg

src/update-check.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.474 matchedPath = src/update-check.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.474 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/update-check.jsView on unpkg

src/transport.jsView file

•matchType = normalized_sha256 matchedPackage = yaver-cli@1.99.474 matchedPath = src/transport.js matchedIdentity = npm:eWF2ZXItY2xp:1.99.474 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/transport.jsView on unpkg