registry / @vercel/cli-support / 65.6.0
@vercel/cli-support@65.6.0
The JavaScript Vercel CLI, installed by `vercel` where no native binary is available
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe manifest has no lifecycle hook, and the flagged hostname is sent as part of Vercel OIDC authentication. The inspected credential and agent setup paths are scoped to Vercel services or require user invocation and confirmation; the secret match is cryptographic key-derivation code.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
OIDC and OpenAPI authentication run when the corresponding CLI features are used; agent setup runs through explicit setup commands.
Impact
No unrelated credential recipient, automatic install-time mutation, or destructive effect was identified.
Mechanism
The CLI includes a hostname in its Vercel OIDC User-Agent, refreshes project tokens through the Vercel API, and constrains SSO cookies to the spec origin. Agent setup stores or applies configuration locally after its consent flow.
AI rationale
The manifest has no lifecycle hook, and the flagged hostname is sent as part of Vercel OIDC authentication. The inspected credential and agent setup paths are scoped to Vercel services or require user invocation and confirmation; the secret match is cryptographic key-derivation code.
Network endpoints3
vercel.com/.well-known/openid-configurationapi.vercel.com/v1/projects/{projectId}/tokenvercel.com/sso-api
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies a Vercel CLI support package and declares no lifecycle script; its dependency list includes the JOSE library used by bundled cryptographic code.
- The hostname appears in the OIDC client User-Agent sent to the Vercel issuer; project token refresh sends the bearer token to the Vercel API.
- OpenAPI authentication sends the Vercel token to Vercel’s SSO endpoint and rejects redirects outside the spec URL’s origin.
- AI Gateway setup recovers credentials from local storage and offers apply, copy, or cancel before configuration changes; the integration helper invokes the setup flow.
- Agent configuration changes are user-invoked: plugin installation has a confirmation gate, and best-practice file updates prompt or require an affirmative option.
- The latest-version worker checks npm and updates a cache, and the shared helper fetches npm distribution tags.
- The integrations command queries Vercel Connect services; framework detection reads the VERCEL_USE_EXPERIMENTAL_FRAMEWORKS setting.
- Several chunks provide date, elapsed-time, table, and stream utilities.
Evidence against
- The OIDC User-Agent includes the machine hostname, but the inspected caller sends it to Vercel’s issuer.
Source & flagged code
13 flaggeddist/commands-blob.jsView file
8patternName = private_key_rsa
severity = critical
line = 8
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/commands-blob.jsView on unpkg · L88patternName = private_key_rsa
severity = critical
line = 8
Critical
dist/commands-ai.jsView file
55`}}],envExports:[{name:GATEWAY_API_KEY_ENV,value:ctx.apiKey}],notes:[`Mistral Vibe will default to ${activeModel} through the gateway; switch with /model.`,...models3.length?[`${mo...
L56: ${import_chalk19.default.dim(" Detected agents are pre-selected \xB7")}${CHECKBOX_INSTRUCTIONS}`,instructions:!1,loop:!1,pageSize:Math.max(choices.length,7),choices})).map(id=>get...
L57: `)}function preservedEnvLines(current,writtenNames){if(!current)return[];let start=current.indexOf(MANAGED_BLOCK_START),end=current.indexOf(MANAGED_BLOCK_END);if(start===-1||end===...
Findings
3 Critical8 High4 Medium6 Low
CriticalCritical Secretdist/commands-blob.js
CriticalPrevious Version Dangerous Deltadist/chunks/chunk-TKKGZI7O.js
CriticalSecret Patterndist/commands-blob.js
HighChild Processdist/commands-ai.js
HighShell
HighSame File Env Network Executiondist/commands-ai.js
HighHost Fingerprint Exfiltrationdist/chunks/chunk-UVHKXCR5.js
HighCommand Output Exfiltrationdist/commands-ai.js
HighSandbox Evasion Gated Capabilitydist/commands-core.js
HighCross File Remote Execution Contextdist/chunks/chunk-5ULKEPKM.js
HighSemantic Analysis Limiteddist/chunks/chunk-4NTBYNFR.js#virtual:normalized:round1
Affected versions and remediation
This report applies to @vercel/cli-support@65.6.0.
See all versions of @vercel/cli-support for other recorded verdicts.
- Review the evidence and your use of @vercel/cli-support@65.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.