@ubean/ai@0.7.11
AI large-model integration for the ubean framework: defineAgent + defineAgentTool + Vue runtime (thin orchestration over the Vercel AI SDK)
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe documented default fallback pairs an OpenAI credential with DeepSeek's endpoint, and agent execution passes that credential to the configured model client. This is cross-service credential disclosure, so the package is malicious under the credential handling rules.
Static reason
No blocking static signals were detected.
Trigger
An application calls agent.run() or stream() without registering or configuring a provider, with OPENAI_API_KEY set and no higher-priority key present.
Impact
The OpenAI credential is disclosed to api.deepseek.com, a service outside the credential's own provider.
Mechanism
The fallback reads OPENAI_API_KEY, pairs it with the default DeepSeek base URL, and passes both to the OpenAI-compatible client for a model request.
Attack narrative
When no provider is configured, the package falls back to OPENAI_API_KEY but defaults requests to DeepSeek. On an agent run, it passes that key and the DeepSeek URL to the model client, exposing the OpenAI credential to a different provider.
AI rationale
The documented default fallback pairs an OpenAI credential with DeepSeek's endpoint, and agent execution passes that credential to the configured model client. This is cross-service credential disclosure, so the package is malicious under the credential handling rules.
Evidence
dist/core-DllixiG1.jsREADME.mddist/gateway.js
Network endpoints1
api.deepseek.com/v1
Decision evidence
public snapshotAI called this Malicious at 93.0% confidence as Malware with low false-positive risk.
Evidence for block
- When no provider is configured, the package selects OPENAI_API_KEY as a fallback credential while defaulting the base URL to https://api.deepseek.com/v1.
- The resolved provider's apiKey and baseURL are passed to the OpenAI-compatible client.
- Calling agent.run() creates the model and invokes generateText, which sends the request using that provider configuration.
Evidence against
- The README documents the fallback and default DeepSeek URL.
- The credential is used when the agent is explicitly run, rather than during installation or import.
Behavioral surface
EnvironmentVars
UrlStrings
NoLicense
Source & flagged code
4 flaggeddist/core-DllixiG1.jsView file
32function envProvider() {
const apiKey = process.env.DEEPSEEK_API_KEY || process.env.UBEAN_AI_API_KEY || process.env.OPENAI_API_KEY;
const baseURL = process.env.UBEAN_AI_API_BASE || "https://api.deepseek.com/v1";
if (!apiKey) return void 0;
return {
id: "env",
kind: "openai-compatible",
baseURL,
apiKey
};
}
/** Declare a typed ubean tool.
High
Ai Review Evidence
When no provider is configured, the package selects OPENAI_API_KEY as a fallback credential while defaulting the base URL to https://api.deepseek.com/v1.
dist/core-DllixiG1.jsView on unpkg · L3274async function createModel() {
const { ai, createOpenAICompatible } = await loadAiSdk();
const { provider, modelId } = resolveModel(config.model);
return {
ai,
model: createOpenAICompatible({
baseURL: provider.baseURL,
name: provider.id,
apiKey: provider.apiKey,
headers: provider.headers
}).chatModel(modelId),
provider
High
Ai Review Evidence
The resolved provider's apiKey and baseURL are passed to the OpenAI-compatible client.
dist/core-DllixiG1.jsView on unpkg · L74130async function run(input) {
const { ai, model } = await createModel();
const tools = await buildTools(input);
const messages = toCoreMessages(input);
const result = await ai.generateText({
model,
system,
me
Findings
4 High1 Medium3 Low
HighAi Review Evidencedist/core-DllixiG1.js
HighAi Review Evidencedist/gateway.js
HighAi Review Evidencedist/core-DllixiG1.js
HighAi Review Evidencedist/core-DllixiG1.js
MediumEnvironment Vars
LowScripts Present
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @ubean/ai@0.7.11.
See all versions of @ubean/ai for other recorded verdicts.
- Avoid installing @ubean/ai@0.7.11. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.