`try`/`catch`'s behavior can be easily overridden

xpcall = (...) -> print 'get hacked idiot'
pcall = xpcall

this changes completely what try/catch does, at least until the end of the current scope, though if this is done at top-level it's impossible to change back
I'd propose accessing the global scope and those functions explicitly when compiling a try/catch:

try
  func 1, 2, 3
catch err
  print yue.traceback err

try
  print "trying"
  func 1, 2, 3

->

_G.xpcall(function() -- 1
  return func(1, 2, 3) -- 2
end, function(err) -- 2
  return print(yue.traceback(err)) -- 4
end) -- 1

_G.pcall(function() -- 17
  print("trying") -- 18
  return func(1, 2, 3) -- 19
end) -- 17

sure, it won't completely block this behavior; anyone who decides to write _G.xpcall = (...) -> is going to invoke this problem, but at least it should be actively harder to do on accident. you shouldn't really be overwriting the protected call functions unless you know precisely what you'll do with them

it's also not the worst thing ever, this is more of a small fix than anything

Start by locating the compiler code that handles try/catch and emits pcall or xpcall, then reproduce the issue with the example in this report. Compare generated Lua when those functions are reassigned and verify that try/catch uses explicit global-scope lookups while preserving the shown error-handling behavior.