@ubean/ai@0.7.12
AI large-model integration for the ubean framework: defineAgent + defineAgentTool + Vue runtime (thin orchestration over the Vercel AI SDK)
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe default fallback routes OPENAI_API_KEY to DeepSeek when no provider is configured. Sending a service credential to a different provider by default is credential exfiltration, even though the behavior is documented and only occurs when the agent creates a model.
Static reason
No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
An application calls an agent with no registered/default provider and only OPENAI_API_KEY available.
Impact
The OpenAI credential is disclosed to a different service; DeepSeek may reject it, but the key is still sent as provider authentication.
Mechanism
The fallback selects OPENAI_API_KEY, defaults the base URL to DeepSeek, and passes the key to the OpenAI-compatible client.
Attack narrative
When an agent creates a model without a configured provider, the fallback can use OPENAI_API_KEY while targeting api.deepseek.com. The package passes that key to the provider client, exposing an OpenAI credential to a different service. This occurs when the application uses the agent; there is no install-time contact.
AI rationale
The default fallback routes OPENAI_API_KEY to DeepSeek when no provider is configured. Sending a service credential to a different provider by default is credential exfiltration, even though the behavior is documented and only occurs when the agent creates a model.
Evidence
dist/core-DllixiG1.jsREADME.md
Network endpoints1
api.deepseek.com
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- With no higher-priority key set, the fallback selects OPENAI_API_KEY.
- The fallback defaults its base URL to https://api.deepseek.com/v1.
- The selected API key is passed to the OpenAI-compatible provider client.
- The README confirms this fallback is used when nothing is configured.
Evidence against
- The manifest has no install or lifecycle scripts.
- The README documents the fallback behavior, and the provider is used when an agent creates a model.
- The package otherwise provides AI model integration and gateway configuration.
Behavioral surface
EnvironmentVars
UrlStrings
NoLicense
Source & flagged code
5 flaggeddist/core-DllixiG1.jsView file
•matchType = malicious_source_fingerprint_signature
signature = eee1828c8d3bb801
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @ubean/ai@0.7.11
matchedPath = dist/core-DllixiG1.js
matchedIdentity = npm:QHViZWFuL2Fp:0.7.11
similarity = 1.000
shingleOverlap = 4
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/core-DllixiG1.jsView on unpkg32function envProvider() {
const apiKey = process.env.DEEPSEEK_API_KEY || process.env.UBEAN_AI_API_KEY || process.env.OPENAI_API_KEY;
const baseURL = process.env.UBEAN_AI_API_BASE || "https:
High
Ai Review Evidence
With no higher-priority key set, the fallback selects OPENAI_API_KEY.
dist/core-DllixiG1.jsView on unpkg · L3233API_KEY;
const baseURL = process.env.UBEAN_AI_API_BASE || "https://api.deepseek.com/v1";
if (!apiKey) return void 0;
return {
id: "env",
kind:
High
Ai Review Evidence
The fallback defaults its base URL to https://api.deepseek.com/v1.
Findings
5 High1 Medium3 Low
HighKnown Malware Source Fingerprint Signaturedist/core-DllixiG1.js
HighAi Review Evidencedist/core-DllixiG1.js
HighAi Review Evidencedist/core-DllixiG1.js
HighAi Review Evidencedist/core-DllixiG1.js
HighAi Review EvidenceREADME.md
MediumEnvironment Vars
LowScripts Present
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @ubean/ai@0.7.12.
See all versions of @ubean/ai for other recorded verdicts.
- Avoid installing @ubean/ai@0.7.12. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.