Filesystem-first framework for durable backend AI agents that run anywhere.
AI Security Review
scanned 3mo ago · by lpm-firewall-ai
The flagged primitives are runtime features of an AI-agent framework, not an install-time payload. Source shows provider-aligned credential handling and no concrete exfiltration, persistence, destructive action, or agent-control hijack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User configures/runs the experimental_chatgpt model or Vercel-backed features.
Impact
Uses configured credentials for requested provider calls; no malicious behavior established.
Mechanism
Scoped provider authentication and local credential refresh.
AI rationale
The flagged primitives are runtime features of an AI-agent framework, not an install-time payload. Source shows provider-aligned credential handling and no concrete exfiltration, persistence, destructive action, or agent-control hijack.
1import{i as e,o as t,t as n}from"../../_chunks/workflow/rolldown-runtime-DaDcL9Zw.js";import{$t as r,A as i,At as a,B as o,Bt as s,C as c,Ct as l,Dn as u,Dt as d,En as f,Et as p,F ...
L2: `).map(e=>{let n=e.match(/^\s*at\s+(?:(.+?)\s+\()?(.+?):(\d+):(\d+)\)?$/);if(!n)return e;let[,i,a,o,s]=n;if(!a.includes(t))return e;let c=parseInt(o,10),l=parseInt(s,10),u=zi(r,{li...
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
1import{i as e,o as t,t as n}from"../../_chunks/node/rolldown-runtime-DaDcL9Zw.js";import{n as r,t as i}from"../../_chunks/node/dist-DsNhwdzf.js";import{n as a,t as o}from"../../_ch...
L2: `)),e.linkname&&(n+=y(` linkpath=`+e.linkname+`
...
L6: `)},n.exports=i})),_t=n((e=>{var t=ht();gt(),e.parse=function(e){return new t(e)}})),vt=n(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=Object.getOwnProp...
L7: ${e.message}`),t?new f.VercelOidcTokenError(t):e}return n}function m(){let e=(0,d.getContext)().headers?.[`x-vercel-oidc-token`]??process.env.VERCEL_OIDC_TOKEN;if(!e)throw Error(`T...
L8: `):t;let n=t.replace(/^/gm,`${kt} `);console.error(Ot[e](n))}function At(e){return F.default.italic(F.default.dim("`")+e+F.default.dim("`"))}var jt=t(a(),1);async function Mt()
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
26`,o?1+l:l),o=!0,s=!0,l=0,r=e.position;!x(h)&&h!==0;)h=e.input.charCodeAt(++e.position);I(e,r,e.position,!1)}return!0}function J(e,t){var n,r=e.tag,i=e.anchor,a=[],o,s=!1,c;for(e.anchor!==null&&(e.anchorMap[e.anchor]=a),c=e.input.charCodeAt(e.position);c!==0&&!(c!==45||(o=e.input.charCodeAt(e.position+1),!C(o)));){if(s=!0,e.position++,B(e,!0,-1)&&e.lineIndent<=t){a.push(null),c=e.input.charCodeAt(e.position);continue}if(n=e.line,Z(e,t,u,!1,!0),a.push(e.result),B(e,!0,-1),c=e.input.charCodeAt(e.position),(e.line===n||e.lineIndent>t)&&c!==0)N(e,`bad indentation of a sequence entry`);else if(e.lin ...
1import{i as e,o as t,t as n}from"../../_chunks/workflow/rolldown-runtime-DaDcL9Zw.js";import{$t as r,A as i,At as a,B as o,Bt as s,C as c,Ct as l,Dn as u,Dt as
1import{i as e,o as t,t as n}from"../../_chunks/node/rolldown-runtime-DaDcL9Zw.js";import{n as r,t as i}from"../../_chunks/node/dist-DsNhwdzf.js";import{n as a,t as o}from"../../_ch...
L2: `)),e.linkname&&(n+=y(` linkpath=`+e.linkname+`
...
L6: `)},n.exports=i})),_t=n((e=>{var t=ht();gt(),e.parse=function(e){return new t(e)}})),vt=n(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=Object.getOwnProp...
L7: ${e.message}`),t?new f.VercelOidcTokenError(t):e}return n}function m(){let e=(0,d.getContext)().headers?.[`x-vercel-oidc-token`]??process.env.VERCEL_OIDC_TOKEN;if(!e)throw Error(`T...
L8: `):t;let n=t.replace(/^/gm,`${kt} `);console.error(Ot[e](n))}function At(e){return F.default.italic(F.default.dim("`")+e+F.default.dim("`"))}var jt=t(a(),1);async function Mt()
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
42`:``}function pe(e,t){return fe(e,n.extend({schema:a},t))}t.exports.dump=fe,t.exports.safeDump=pe})),require_js_yaml$1=__commonJSMin(((e,t)=>{var n=require_loader(),r=require_dumper();function i(e){return function(){throw Error(`Function `+e+` is deprecated and cannot be used.`)}}t.exports.Type=require_type(),t.exports.Schema=require_schema(),t.exports.FAILSAFE_SCHEMA=require_failsafe(),t.exports.JSON_SCHEMA=require_json(),t.exports.CORE_SCHEMA=require_core(),t.exports.DEFAULT_SAFE_SCHEMA=require_default_safe(),t.exports.DEFAULT_FULL_SCHEMA=require_default_full(),t.exports.load=n.load,t.export ...
43return `+str.trim()+`;
44}());`),eval(str)||{}}catch(e){if(wrap!==!1&&/(unexpected|identifier)/i.test(e.message))returnparse(str,options,!1);throwSyntaxError(e)}},stringify:function(){throwError(`stringifying JavaScript is not supported`)}}})),require_strip_bom_string=__commonJSMin(((e,t)=>{t.exports=function(e){returntypeof e==`string`&&e.charAt(0)===``?e.slice(1):e}})),require_utils=__commonJSMin((e=>{let t=require_strip_bom_string(),n=require_kind_of();e.define=function(e,t,n){Reflect.defineProperty(e,t,{enumerable:!1,configurable:!0,writable:!0,value:n})},e.isBuffer=function(e){returnn(e)===`buffer`},e.isObj ...
45`?e:e+`
Low
Eval
Package source references a known benign dynamic code generation pattern.
2`))}async function terminate(e){e.exitCode!==null||e.killed||(e.kill(`SIGTERM`),await Promise.race([once(e,`exit`),setTimeout(2e4).then(()=>`timeout`)])===`timeout`&&e.exitCode===null&&(e.kill(`SIGKILL`),await once(e,`exit`)),e.stdout?.destroy(),e.stderr?.destroy())}function once(e,t){return new Promise(n=>{e.once(t,()=>n())})}async function startProductionServer(e,r={}){let o=resolve(e),s=resolveOutputServerEntry(o);if(!existsSync(s))throw Error(`Missing eve build output at ${s}. Run "eve build" before "eve start".`);loadDevelopmentEnvironmentFiles(o),await prewarmBuiltAppSandboxes({appRoot:o ...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/src/internal/nitro/host/start-production-server.jsView on unpkg · L1
3`)))})});h.catch(()=>void0);try{return{asyncclose(){f=!0,awaitterminate(m)},url:awaitwaitForReady({child:m,getStartError:()=>p,getOutput:()=>d,knownUrl:u}),asyncwait(){await h}}}catch(e){throw f=!0,awaitterminate(m),isRecord(e)&&e.name===`AbortError`?Error(`Timed out waiting for built eve server to respond.`,{cause:e}):e}}export{startProductionServer};
Long lines were clipped for display.
•matchType = previous_version_dangerous_delta
matchedPackage = eve@0.27.12
matchedIdentity = npm:ZXZl:0.27.12
similarity = 0.550
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/src/internal/nitro/host/start-production-server.jsView on unpkg
=
Object.getOwnPropertyNames,a
=
Object
.
prototype
.hasOwnProperty,
o
=
(
e
,
t
)
=>
{
for
(
var
r
in
t)
n
(e,r,{get:t[r],enumerable:
!
0
})},
s
=
(
e
,
t
,
o
,
s
)
=>
{
if
(t
&&typeof
t
==
`object`
||typeof
t
==
`function`
)
for
(
let
c
of
i
(t))
!
a.
call
(e,c)
&&
c
!==
o
&&
n
(e,c,{
get
:()
=>
t[c],enumerable:
!
(s
=
r
(t,c))
||
s.enumerable});
return
e},
c
=
e
=>
s
(
n
({},
`__esModule`
,{value:
!
0
}),e),l
=
{};
o
(l,{
VercelOidcTokenError
:()
=>
u}),t.exports
=
c
(l);
var
u
=class
extends
Error
{
constructor
(
e
,
t
){
super
(e),
this
.name
=
`Verce ...
2`)}asyncfunctionm(e){try{if(!(await(0,d.stat)(e)).isDirectory())throwError(`not a directory`)}catch{thrownewf({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON.stringify(e)} does not exist or is not a directory.`})}}functionh(e,t){if(typeof t==`object`&&t){let n=t;if(n.code===`ENOENT`)returnnewf({code:`VERCEL_CLI_NOT_FOUND`,message:`Unable to find Vercel CLI command ${JSON.stringify(e.command)}.`,invocation:e,cause:t});if(n.code===`EACCES`||n.code===`EPERM`)returnnewf({code:`VERCEL_CLI_PERMISSION_DENIED`,message:`Permission denied while executing Vercel CLI command ${J...
4`);return_?(a.originalMessage=a.message,a.message=y):a=Error(y),a.shortMessage=v,a.command=c,a.escapedCommand=l,a.exitCode=s,a.signal=o,a.signalDescription=m,a.stdout=e,a.stderr=t,i!==void0&&(a.all=i),`bufferedData`ina&&deletea.bufferedData,a.failed=!0,a.timedOut=!!u,a.isCanceled=d,a.killed=f&&!u,a}})),re=i(((e,t)=>{let n=[`stdin`,`stdout`,`stderr`],r=e=>n.some(t=>e[t]!==void 0),i=e=>{if(!e)return;let{stdio:t}=e;if(t===void 0)return n.map(t=>e[t]);if(r(e))throw Error(`It's not possible to provide \`stdio\` in combination with one of ${n.map(e=>`\`${e}\``).join(`, `)}`);if(typeof t==`string ...
5`)}var jt,Mt,V,Nt=n((()=>{Te(),B(),jt=(e,t)=>{e.name=`$ZodError`,Object.defineProperty(e,"_zod",{value:e._zod,enumerable:!1}),Object.defineProperty(e,"issues",{value:t,enumerable:!1}),e.message=JSON.stringify(t,Ne,2),Object.defineProperty(e,"toString",{value:()=>e.message,enumerable:!1})},Mt=k(`$ZodError`,jt),V=k(`$ZodError`,jt,{Parent:Error})})),Pt,Ft,It,Lt,Rt,zt,Bt,Vt,Ht,Ut,Wt,Gt,Kt,qt,Jt,Yt,Xt,Zt,Qt,$t,en,tn,nn,rn,an=n((()=>{Te(),Nt(),B(),Pt=e=>(t,n,r,i)=>{let a=r?Object.assign(r,{async:!1}):{async:!1},o=t._zod.run({value:n,issues:[]},a);if(o instanceof Promise)throw new j;if(o.issues.lengt ...
6`).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let e=Function,t=this?.args,n=[...(this?.content??[``]).map(e=>` ${e}`)];return newe(...t,n.join(`