registry / @vercel/cli-support / 65.5.0
@vercel/cli-support@65.5.0
The JavaScript Vercel CLI, installed by `vercel` where no native binary is available
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe host identity signal is OIDC client identification sent to Vercel, and the inspected credential flows remain within Vercel authentication or explicit CLI setup paths. Agent plugin changes require a user-run setup command and confirmation; no install-time attack or concrete malicious behavior was identified.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs a Vercel CLI authentication, OpenAPI, or agent plugin setup command.
Impact
No unrelated credential transfer, unconsented agent configuration change, or other malicious effect was established.
Mechanism
The package sends host and platform details as OIDC user-agent data, uses Vercel authentication for Vercel services, and prompts before plugin setup.
AI rationale
The host identity signal is OIDC client identification sent to Vercel, and the inspected credential flows remain within Vercel authentication or explicit CLI setup paths. Agent plugin changes require a user-run setup command and confirmation; no install-time attack or concrete malicious behavior was identified.
Network endpoints3
vercel.com/.well-known/openid-configurationapi.vercel.com/v1/projects/${projectId}/tokenvercel.com/sso-api
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies this as Vercel CLI support and includes the built distribution.
- The OIDC user agent includes host and platform details, and its discovery request goes to Vercel; project token refresh sends authorization to api.vercel.com.
- OpenAPI authentication sends the Vercel token to Vercel SSO and rejects redirects outside the original spec origin.
- Agent plugin setup is invoked through CLI commands and asks for confirmation; declining Claude setup disables its saved auto-update preference.
- The reviewed credential paths support local AI Gateway setup or explicit Blob commands; no unrelated recipient was identified.
- The integrations command imports helpers for environment validation, project resource connections, and terminal sanitization.
- The inspected chunks include bundled matching and table formatting dependencies, plus elapsed-time display helpers.
- The stream helper bundles end-of-stream handling, and the dist-tag module documents fetching npm package tags with a timeout.
Evidence against
Behavioral surface
Source & flagged code
12 flaggeddist/commands-blob.jsView file
8patternName = private_key_rsa
severity = critical
line = 8
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/commands-blob.jsView on unpkg · L88patternName = private_key_rsa
severity = critical
line = 8
Critical
dist/commands-ai.jsView file
55`}}],envExports:[{name:GATEWAY_API_KEY_ENV,value:ctx.apiKey}],notes:[`Mistral Vibe will default to ${activeModel} through the gateway; switch with /model.`,...models3.length?[`${mo...
L56: ${import_chalk19.default.dim(" Detected agents are pre-selected \xB7")}${CHECKBOX_INSTRUCTIONS}`,instructions:!1,loop:!1,pageSize:Math.max(choices.length,7),choices})).map(id=>get...
L57: `)}function preservedEnvLines(current,writtenNames){if(!current)return[];let start=current.indexOf(MANAGED_BLOCK_START),end=current.indexOf(MANAGED_BLOCK_END);if(start===-1||end===...
Findings
2 Critical8 High4 Medium6 Low
CriticalCritical Secretdist/commands-blob.js
CriticalSecret Patterndist/commands-blob.js
HighChild Processdist/commands-ai.js
HighShell
HighSame File Env Network Executiondist/commands-ai.js
HighHost Fingerprint Exfiltrationdist/chunks/chunk-UVHKXCR5.js
HighCommand Output Exfiltrationdist/commands-ai.js
HighSandbox Evasion Gated Capabilitydist/commands-core.js
HighCross File Remote Execution Contextdist/chunks/chunk-5WYPJ2T5.js
HighSemantic Analysis Limiteddist/chunks/chunk-4NTBYNFR.js#virtual:normalized:round1
MediumDynamic Requiredist/get-latest-worker.cjs
Medium
Affected versions and remediation
This report applies to @vercel/cli-support@65.5.0.
See all versions of @vercel/cli-support for other recorded verdicts.
- Review the evidence and your use of @vercel/cli-support@65.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.