rules-yarn

yarn dlx downloads and executes a package without installing it. Without a version pin, it always fetches the latest release — a compromised release executes immediately in your project.

'yarn patch' modifies a dependency directly. The patch must be committed via 'yarn patch-commit' to the .yarn/patches directory to persist across reinstalls.

Publishing via yarn is permanent (except within 72 hours). Verify version, build output, and .npmignore before publishing.

yarn resolutions silently override transitive dependency versions across the entire dependency tree. Incorrect resolutions can mask security vulnerabilities or introduce incompatible versions.

Yarn plugins listed in .yarnrc.yml execute code during yarn operations. A malicious or compromised plugin can intercept installs, intercept publishes, or alter dependency resolution.

Caret (^) and tilde (~) version ranges produce non-reproducible installs. Use exact version pins to ensure every 'yarn install' resolves identically.

yarn.lock must not be hand-edited. It is machine-generated by 'yarn install'. Manual edits corrupt integrity checksums and break reproducible installs.

postinstall/preinstall/install lifecycle scripts execute automatically when any consumer runs 'yarn install' on your package (CWE-829, supply-chain RCE). This is the primary vector used in malicious npm/yarn packages (e.g., event-stream, node-ipc). Audit the script body carefully and strongly prefer moving setup steps to an explicit 'yarn prepare' that only runs locally.

yarn unpublish is blocked. Removing a published package version breaks all projects depending on it and cannot be undone after 72 hours. Use 'yarn npm deprecate' to discourage use without removing.

Hardcoded npmAuthToken in .yarnrc.yml exposes registry credentials in source control. Use environment variable substitution: npmAuthToken: '${NPM_AUTH_TOKEN}'

enableScripts: true re-enables lifecycle script execution if it was disabled globally (e.g., via a parent .yarnrc.yml or CI policy). Lifecycle scripts are the primary supply-chain RCE vector in the npm/yarn ecosystem. Only set this if every package in your dependency tree is audited. Prefer the default (false in Yarn 4+) or per-package allowlisting.

npmRegistryServer is set to a plain-HTTP URL. All registry traffic must use HTTPS to prevent a network attacker from serving tampered packages (CWE-319). Change the URL scheme to https://.

unsafeHttpWhitelist in .yarnrc.yml permits Yarn to download packages over plain HTTP. Plain HTTP connections have no transport security and allow a network attacker to replace a package with malicious code (MiTM, CWE-319). Remove this key; all registry traffic must go over HTTPS.