
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
yaver-cli
Advanced tools
Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime
Hermes bytecode compiler binaries matched to react-native@0.81.5
(Hermes BC version 96, the version baked into the Yaver container app).
darwin-arm64/ and darwin-x64/ ship with the tarball as a macOS
universal binary. They're small (~6 MB) and cover the vast majority
of yaver-push users.linux-x64, win32-x64) are installed at
npm install -g yaver-cli time by src/postinstall.js → it extracts
the right binary from the react-native npm tarball.linux-arm64 has no upstream prebuilt. On first push, bundler.js
falls back to getHermescPathAsync({ allowBuildFromSource: true }),
which builds hermesc from the project's own
node_modules/react-native/sdks/hermes/ sources via CMake. Takes
~3–5 min, cached afterwards.<platform>-<arch> key)~/.yaver/hermesc/<key>/hermesc (per-user mirror)hermesc or hermesc.exe)node_modules/react-native/sdks/hermesc/...Never commit binaries into platform subdirs other than the two
macOS ones — the installer writes them at install time and
committing them would make every git pull churn large files.
FAQs
Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime
The npm package yaver-cli receives a total of 3,069 weekly downloads. As such, yaver-cli popularity was classified as popular.
We found that yaver-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.