yarn

📦🐈 Fast, reliable, and secure dependency management.

Latest 1.22.22

NPM

58%

Total Score

Maintainer Stability

Maturity

Supply Chain

Attestations

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher provenance was recorded, leaving publication origin less verifiable than it could be.

Lifecycle scripts

The package runs a preinstall lifecycle script, adding install-time execution surface; this is a supply-chain hygiene concern even though the signal gives no evidence of harmful behavior.

Release history

The package has a long history and 120 releases, but no registry release in about two years, which indicates materially reduced maintenance activity.

Repo commit activity

The repository recorded zero commits and zero active maintainers over the last three months; combined with the stale registry release history, this raises abandonment risk.

Repo issue activity

There were no new or closed issues or pull requests in the last month, consistent with a project whose maintenance activity has substantially slowed.

Vulnerabilities

Title	Versions	Severity
CVE-2021-4435 yarn is vulnerable to Untrusted Search Path in versions 0.0.0 - 1.22.13.	0.0.0 - 1.22.13	High
CVE-2019-15608 yarn is vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in versions 0.0.0 - 1.19.0.	0.0.0 - 1.19.0	Medium
CVE-2020-8131 yarn is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 1.21.1.	0.0.0 - 1.21.1	High
CVE-2019-10773 yarn is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 0.0.0 - 1.21.1.	0.0.0 - 1.21.1	High
CVE-2019-5448 yarn is vulnerable to Missing Encryption of Sensitive Data in versions 0.0.0 - 1.17.3.	0.0.0 - 1.17.3	High