Yarn Classic
yarnpkg/yarnReviewed by AI
What it does
Yarn is a package manager for JavaScript projects: it downloads the libraries a project depends on, writes a lock file so everyone installs exactly the same versions, caches what it fetched so it works offline, and checks each package against a checksum. This repository is the old 1.x line. Its own README says the line is frozen, that new work happens in the yarnpkg/berry repository, and that users who hit bugs should move to the newer releases. It is for programmers; you need Node.js and you use it from a terminal.
How easy it is to install
C · install 1 or 2 tools · Windows
- Windows C
- macOS C
- Linux C
On all three you first install Node.js and then install Yarn and use it by typing commands. Windows has a 2 MB .msi and Linux has .deb and .rpm packages in the last release; macOS has no file in the releases and is covered only by the install guide on the project website.
Numbers on GitHub
- Stars
- 41,466on Oct 31, 2026
- Downloads
- 272,196,225472,809 this week
- Growth
- —no gain in the last reading
Stars over time
Facts
- Runs on
- Windows, macOS, Linux
- You need to install
- Node.js
- To build from source
- Node.js
- Disk space
- 2 MB–5 MB · from the installer
- Accounts or keys
- None
- Cost
- Free
- License
- BSD-2-Clause (Permissive)
- Last update
- Feb 12, 2026
Risk signals (7)
- Attentionstale releases
Last release on 2024-03-09 (963 days ago)
automatic check
- Attentionfrozen line the authors tell you to migrate
The repository description is 'The 1.x line is frozen - features and bugfixes now happen on https://github.com/yarnpkg/berry', and the README adds: 'If you hit bugs or issues with Yarn 1.x, we strongly suggest you migrate to the latest release'. The contributing section says 'The 1.x codebase is fairly old and will only accept security fixes.'
AI review
- Attentionvery old dependencies
package.json still depends on long-deprecated packages, including `request` ^2.87.0 (the request project was deprecated in 2020), `babel-runtime` ^6.26.0, `micromatch` ^2.3.11, `mkdirp` ^0.5.1 and `rimraf` ^2.5.0, and declares `engines.node: >=4.0.0`.
AI review
- Infoa ci token is published in the readme
The README build badge embeds a token in its URL: 'https://circleci.com/gh/yarnpkg/yarn.svg?style=shield&circle-token=5f0a78473b0f440afb218bf2b82323cc6b3cb43f'. Badge tokens are meant to be read-only, but a credential is sitting in a public file.
AI review
- Infounreleased version in the source
package.json says version '1.23.0-0' while the newest published release is v1.22.22 from 2024-03-09, so the code in the repository is ahead of anything released. The last commit was 2026-02-12.
AI review
- Infoa large backlog on a closed line
Project facts: 2055 open issues, on a line the maintainers say accepts only security fixes.
AI review
- Infosponsor logos with tracking links
The README 'Gold sponsors' table links Doppler and WorkOS through campaign URLs such as 'https://www.doppler.com/?utm_campaign=github_repo&utm_medium=referral&utm_content=yarn&utm_source=github'; both are paid commercial services.
AI review
Evidence is shown in its original language.
What Radar could not check
- Whether the old dependencies still install cleanly on current Node.js versions
- Whether security fixes are still being published, given the last release was in March 2024
- What the unreleased 1.23.0-0 code in the repository changes compared with 1.22.22
- How the macOS install path behaves, since no macOS file ships in the releases
- Real disk use after the package cache grows on a working machine