Kong/insomnia · error

Unsafe yarn path detected.

Error message

Unsafe yarn path detected.

What it means

Security guard in getYarnPath: the resolved path to yarn-standalone.js does not begin with the app's base directory (SAFE_APP_BASE), so the bundled yarn cannot be trusted. Indicates an unexpected app installation layout or tampering.

Solutions

1. Reinstall the app so binaries live under the expected app folder
2. Verify no symlink/shim is redirecting the app path
3. Run the official build rather than a relocated copy

When it happens

Trigger: Thrown at packages/insomnia/src/main/install-plugin.ts:334 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Kong/insomnia@d9bb2b0142 (2026-08-26). Data as JSON: /api/errors/84394c2215b01f1d. Report an issue: GitHub.

Appendix: source

Thrown at packages/insomnia/src/main/install-plugin.ts:334

 * Ensures no symlinks and the path is within the app folder.
 */
export async function getYarnPath() {
  const SAFE_APP_BASE = path.resolve(__dirname, '..');

  const appPath = app.getAppPath();
  const resolvedAppPath = path.resolve(appPath);

  // Validate app path is safe
  if (!resolvedAppPath.startsWith(SAFE_APP_BASE)) {
    throw new Error('Unsafe app path detected.');
  }

  const yarnPath = isDevelopment()
    ? path.resolve(resolvedAppPath, './bin/yarn-standalone.js')
    : path.resolve(resolvedAppPath, '../bin/yarn-standalone.js');

  if (!yarnPath.startsWith(SAFE_APP_BASE)) {
    throw new Error('Unsafe yarn path detected.');
  }

  // Ensure file exists and is not a symlink
  try {
    const stats = await lstat(yarnPath);

    if (stats.isSymbolicLink()) {
      throw new Error('yarn-standalone.js is a symlink, refusing to use it.');
    }
  } catch (err: any) {
    if (err.code === 'ENOENT') {
      throw new Error(`yarn-standalone.js not found at expected location: ${yarnPath}`);
    }
    throw err;
  }

  return yarnPath;
}

View on GitHub (pinned to d9bb2b0142)