CVE-2026-24467: Yarnrc Missing Enable Scripts False

`.yarnrc.yml` does not contain `enableScripts: false`. Yarn 4 executes install/postinstall lifecycle scripts from every (transitive) dependency by default. A malicious or compromised package resolved into the lockfile (typosquat, hijack, freshly published version) can therefore obtain arbitrary code execution on any developer or CI machine that runs `yarn in

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0Generic
greprules fetch cve-2026-24467-yarnrc-missing-enable-scripts-false --engine opengrep

Description

`.yarnrc.yml` does not contain `enableScripts: false`. Yarn 4 executes install/postinstall lifecycle scripts from every (transitive) dependency by default. A malicious or compromised package resolved into the lockfile (typosquat, hijack, freshly published version) can therefore obtain arbitrary code execution on any developer or CI machine that runs `yarn in