CodeVetter · Repo Unpack · Risk map
yarnpkg/berry
These are security-sensitive source observations and one explicitly labeled review hypothesis, not confirmed vulnerabilities. The main boundaries involve dynamic code, inherited environments, authenticated network requests, archive integrity, and filesystem mutation. Persistence ordering and a documented symlink uncertainty also warrant care when changing critical flows.
- Dynamic plugin loading executes dynamicRequire(pluginPath) and factory(pluginRequire); builtin modules remain available. Missing HTTP-sourced plugins are downloaded and written locally, with checksum enforcement conditional on a configured checksum.
- Package lifecycle scripts can execute preinstall/install/postinstall or synthesized node-gyp rebuild; soft links, built metadata, enableScripts, and architecture gate these builds, while explicit run executes selected scripts through the shell.
- Configuration reads a home RC file and configured environment files outside the immediate project boundary; makeScriptEnv copies the resulting environment into subprocess environments and prepends temporary wrappers to PATH.
- Network policy is configurable: unsafe HTTP requires a hostname whitelist, enableNetwork can block requests, enableStrictSsl controls certificate rejection, and optional CA/certificate/key paths are read. npm authentication may supply hook headers, bearer tokens, Basic credentials, or OIDC tokens.
- Archive mismatch handling depends on checksumBehavior: ignore preserves the expected hash, update accepts the actual hash, reset rejects the cached entry, and throw errors; check-cache overrides mismatch handling to throw, while linking requests skipIntegrityCheck.
- Installation persists manifests/lockfile before linking and saves state before post-install validation; PnP finalization can remove detected node_modules or obsolete loader/unplugged artifacts, so failures can follow filesystem changes.
- initializeWorkspaceEnvironment realpaths package.json to choose default cwd; its source comment explicitly says tests for that behavior are absent and the historical symlink use case is uncertain. This is a documented local coverage concern.
- Review hypothesis: Smart merge crosses a consequential artifact trust boundary because pull_request_target checks out the PR head to generate a patch, then a separate job applies that artifact and pushes using a bot token. Exploitability was not assessed. (inferred)