registry / eve / 0.22.3

eve@0.22.3

Filesystem-first framework for durable backend AI agents that run anywhere.

AI Security Review

scanned 4mo ago · by lpm-firewall-ai

Source inspection shows a legitimate Vercel eve AI-agent framework with explicit CLI/runtime capabilities and no npm lifecycle execution. Scanner hits map to bundled dependencies and expected user-invoked framework behavior rather than a concrete malicious chain.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit user invocation such as eve, eve init, eve dev, eve start, or application runtime APIs.

Impact

No evidence of credential exfiltration, persistence, destructive behavior, dependency confusion, or unconsented AI-agent control-surface mutation.

Mechanism

User-invoked agent framework CLI and runtime networking/sandbox features.

AI rationale

Evidence

package.jsonbin/eve.jsdist/src/cli/run.jsdist/src/cli/commands/init.jsdist/src/cli/commands/init-repl.jsdist/src/cli/commands/agent-instructions.jsdist/src/compiler/model-catalog.jsdist/src/internal/nitro/host/start-production-server.js

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

bin/eve.js uses child_process.spawn to bootstrap/run the CLI and rebuild workspace sources if invoked from a source checkout.
dist/src/cli/commands/init.js can run package-manager installs and spawn coding-agent REPLs, but only from explicit eve init handoff flow.
dist/src/compiler/model-catalog.js fetches https://ai-gateway.vercel.sh/v1/models/catalog and caches under .eve/cache/model-catalog.json.

Evidence against

package.json has no preinstall/install/postinstall lifecycle scripts.
bin/eve.js direct execution only loads dist/src/cli/run.js after Node version/build checks; no credential harvesting or broad config mutation seen.
dist/src/cli/commands/agent-instructions.js only reads bundled prompt markdown and prints handoff instructions.
dist/src/cli/commands/init-repl.js targets known local REPL commands after interactive selection/explicit handoff, not install-time mutation.
dist/src/internal/nitro/host/start-production-server.js spawns the user's built .output/server/index.mjs for eve start and waits on local health.
Network use is framework-aligned client/server functionality, model catalog lookup, Vercel auth, OpenAPI/MCP connections, and user-requested web fetch tooling.

Source & flagged code

13 flagged

dist/src/compiled/experimental-ai-sdk-code-mode/index.jsView file

4patternName = aws_access_key severity = critical line = 4 matchedText = }`)?t:r....E=";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/compiled/experimental-ai-sdk-code-mode/index.jsView on unpkg · L4

4patternName = aws_access_key severity = critical line = 4 matchedText = }`)?t:r....E=";

Critical

Secret Pattern

AWS access key ID in dist/src/compiled/experimental-ai-sdk-code-mode/index.js

dist/src/compiled/experimental-ai-sdk-code-mode/index.jsView on unpkg · L4

bin/eve.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

3import { spawn } from "node:child_process";

4import { access, readdir, realpath, stat } from "node:fs/promises";

High

Child Process

Package source references child process execution.

bin/eve.jsView on unpkg · L2

5import { createRequire } from "node:module";

6import { dirname, resolve } from "node:path";

7import { fileURLToPath, pathToFileURL } from "node:url";

9const require = createRequire(import.meta.url);

10const packageJson = require("../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/eve.jsView on unpkg · L8

11const packageNodeEngine = packageJson.engines?.node;

12const bootstrapPackageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");

13let semverPromise;

15if (typeof packageNodeEngine !== "string") {

16 throw new Error("eve package.json must declare a valid engines.node range.");

17}

19function createBootstrapOptions(overrides = {}) {

20 const packageRoot = overrides.packageRoot ?? bootstrapPackageRoot;

22 return {

23 cliEntrypointPath:

24 overrides.cliEntrypointPath ?? resolve(packageRoot, "dist", "src", "cli", "run.js"),

25 packageRoot,

26 postBuildScriptPaths: overrides.postBuildScriptPaths ?? [

27 resolve(packageRoot, "scripts", "copy-compiled-assets.mjs"),

28 resolve(packageRoot, "scripts", "copy-runtime-assets.mjs"),

2Cross-file remote execution chain: bin/eve.js spawns dist/src/compiled/experimental-ai-sdk-code-mode/index.js; helper contains network access plus dynamic code execution. L2: L3: import { spawn } from "node:child_process"; L4: import { access, readdir, realpath, stat } from "node:fs/promises"; ... L9: const require = createRequire(import.meta.url); L10: const packageJson = require("../package.json"); L11: const packageNodeEngine = packageJson.engines?.node; ... L350: } L351: process.exitCode = 1; L352: } finally {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/eve.jsView on unpkg · L2

dist/src/compiled/gray-matter/index.jsView file

Lines 23-48javascript

23`,o?1+l:l)):u?(u=!1,e.result+=n.repeat(`

24`,l+1)):l===0?o&&(e.result+=` `):e.result+=n.repeat(`

25`,l):e.result+=n.repeat(`

26`,o?1+l:l),o=!0,s=!0,l=0,r=e.position;!x(h)&&h!==0;)h=e.input.charCodeAt(++e.position);I(e,r,e.position,!1)}return!0}function J(e,t){var n,r=e.tag,i=e.anchor,a=[],o,s=!1,c;for(e.anchor!==null&&(e.anchorMap[e.anchor]=a),c=e.input.charCodeAt(e.position);c!==0&&!(c!==45||(o=e.input.charCodeAt(e.position+1),!C(o)));){if(s=!0,e.position++,B(e,!0,-1)&&e.lineIndent<=t){a.push(null),c=e.input.charCodeAt(e.position);continue}if(n=e.line,Z(e,t,u,!1,!0),a.push(e.result),B(e,!0,-1),c=e.input.charCodeAt(e.position),(e.line===n||e.lineIndent>t)&&c!==0)N(e,`bad indentation of a sequence entry`);else if(e.lin ...

27`),e.charCodeAt(

dist/src/compiled/@workflow/core/runtime.jsView file

Lines 1-3javascript

1import{a as e,i as t,r as n,t as r}from"../../_chunks/workflow/chunk-BHKSVoKr.js";import{a as i,c as a,h as o,l as s,m as c,n as l,o as

dist/src/internal/authored-module-loader.jsView file

Lines 1-2javascript

1import{createRequire}from"node:module";import{expectObjectRecord}from"#internal/authored-module.js";import{existsSync,mkdirSync,realpathSync,statSync,writeFileSync}from"node:fs";import{dirname,isAbsolute,join,resolve,sep}from"node:path";import{createHash}from"node:crypto";import

dist/src/internal/nitro/host/start-production-server.jsView file

Lines 1-3javascript

1import{EVE_HEALTH_ROUTE_PATH}from"#protocol/routes.js";import{existsSync}from"node:fs";import{join,resolve}from"node:path";import{spawn}from"node:child_process";import{loadDevelopmentEnvironmentFiles}from"#cli/dev/environment.js";import

dist/src/compiled/@workflow/world-local/index.jsView file

Lines 1-4javascript

1import{a as e,i as t,t as n}from"../../_chunks/workflow/chunk-BHKSVoKr.js";import{i as r,n as i,r as a,t as o}from"../../_chunks/workflow/dist-CttsoN4D.js";import{C as

dist/src/compiled/@vercel/sandbox/index.jsView file

1import{c as e,n as t,o as n,r,t as i}from"../../_chunks/node/dist-BdTs18CF.js";import{n as a,t as o}from"../../_chunks/node/retry-DkR2H1Y0.js";import{a as s,c,d as l,f as u,i as d,... L2: `)||e.includes(`\r`)||e.includes(`\0`))===!1}function j(e){let t=(e.headersList.get(`referrer-policy`,!0)??``).split(`,`),n=``;if(t.length)for(let e=t.length;e!==0;e--){let r=t[e-1... ... L4: `),a=[],o=new Uint8Array([13,10]);l=0;let u=!1;for(let[t,s]of e)if(typeof s==`string`){let e=S.encode(n+`; name="${r(i(t))}"\r\n\r\n${i(s)}\r\n`);a.push(e),l+=e.byteLength}else{let... L5: Content-Type: ${s.type||`application/octet-stream`}\r\n\r\n`);a.push(e,s,o),typeof s.size==`number`?l+=e.byteLength+s.size+o.byteLength:u=!0}let d=S.encode(`--${t}--\r\n`);a.push(d... L6: `:C+=`connection: close\r ... L9: \r L10

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/compiled/@vercel/sandbox/index.jsView on unpkg · L1

dist/src/compiled/jose/index.jsView file

2patternName = private_key_rsa severity = critical line = 2 matchedText = `)}\n---...fy};

Critical

Secret Pattern

RSA private key in dist/src/compiled/jose/index.js

dist/src/compiled/jose/index.jsView on unpkg · L2

Source & flagged code

13 flagged · loading source

dist/src/compiled/experimental-ai-sdk-code-mode/index.jsView file

4patternName = aws_access_key severity = critical line = 4 matchedText = }`)?t:r....E=";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/compiled/experimental-ai-sdk-code-mode/index.jsView on unpkg · L4

4patternName = aws_access_key severity = critical line = 4 matchedText = }`)?t:r....E=";

Critical

Secret Pattern

AWS access key ID in dist/src/compiled/experimental-ai-sdk-code-mode/index.js

dist/src/compiled/experimental-ai-sdk-code-mode/index.jsView on unpkg · L4

bin/eve.jsView file

2L3: import { spawn } from "node:child_process"; L4: import { access, readdir, realpath, stat } from "node:fs/promises";

High

Child Process

Findings

4 Critical6 High6 Medium7 Low

CriticalCritical Secretdist/src/compiled/experimental-ai-sdk-code-mode/index.js

CriticalTrojan Source Unicodedist/src/compiled/gray-matter/index.js

CriticalSecret Patterndist/src/compiled/experimental-ai-sdk-code-mode/index.js

CriticalSecret Patterndist/src/compiled/jose/index.js

HighChild Processbin/eve.js

HighShell

HighSame File Env Network Executiondist/src/internal/nitro/host/start-production-server.js

HighCommand Output Exfiltrationdist/src/compiled/@workflow/world-local/index.js

HighSandbox Evasion Gated Capabilitydist/src/compiled/@vercel/sandbox/index.js

HighCross File Remote Execution Contextbin/eve.js

Medium

Affected versions and remediation

This report applies to eve@0.22.3.

See all versions of eve for other recorded verdicts.

Review the evidence and your use of eve@0.22.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-09 18:59:11.067Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code