
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
yaver-cli
Advanced tools
Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime
Hermes bytecode compiler binaries matched to react-native@0.81.5
(Hermes BC version 96, the version baked into the Yaver container app).
darwin-arm64/ and darwin-x64/ ship with the tarball as a macOS
universal binary. They're small (~6 MB) and cover the vast majority
of yaver-push users.linux-x64, win32-x64) are installed at
npm install -g yaver-cli time by src/postinstall.js → it extracts
the right binary from the react-native npm tarball.linux-arm64 has no upstream prebuilt. On first push, bundler.js
falls back to getHermescPathAsync({ allowBuildFromSource: true }),
which builds hermesc from the project's own
node_modules/react-native/sdks/hermes/ sources via CMake. Takes
~3–5 min, cached afterwards.<platform>-<arch> key)~/.yaver/hermesc/<key>/hermesc (per-user mirror)hermesc or hermesc.exe)node_modules/react-native/sdks/hermesc/...Never commit binaries into platform subdirs other than the two
macOS ones — the installer writes them at install time and
committing them would make every git pull churn large files.
FAQs
Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime
The npm package yaver-cli receives a total of 2,145 weekly downloads. As such, yaver-cli popularity was classified as popular.
We found that yaver-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.