Loading npm security reports…

eve@0.31.3: Clean npm security report (Allow) | LPM Firewall

registry / eve / 0.31.3

eve@0.31.3

Filesystem-first framework for durable backend AI agents that run anywhere.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime network and filesystem actions implement explicit framework/CLI features.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User imports/configures an MCP connection or invokes an eve CLI command.

Impact

No unconsented installation-time mutation or exfiltration established.

Mechanism

User-configured agent framework, CLI scaffolding, and MCP client.

Rationale

Direct inspection shows normal user-invoked AI framework behavior and no lifecycle hook. The reported host signal is a Vercel OIDC user-agent/refresh implementation in a vendored compiled chunk, not host-fingerprint exfiltration.

Evidence

package.jsonbin/eve.jsdist/src/runtime/connections/mcp-client.jsdist/src/compiled/_chunks/workflow/token-util-DNwIAn_u.jsdist/src/cli/commands/init.jsdist/src/runtime/connections/resolve-authorization.jsdist/src/runtime/connections/scoped-authorization.js

Network endpoints2

vercel.com/.well-known/openid-configurationapi.vercel.com/v1/projects/${t}/token?source=vercel-oidc-refresh${n?`&teamId=${n}`:``}

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for block

package.json has no preinstall/install/postinstall hooks.
bin/eve.js runs only when the eve CLI is invoked.
mcp-client.js connects only to user-configured MCP URLs and authorization.
token-util contains vendored Vercel OIDC refresh logic, not package host harvesting.
cli/commands/init.js scaffolds and installs only after explicit `eve init`.

Evidence against

No install-time execution or foreign agent-config mutation found.
No credential/file collection-and-exfiltration chain found.
CLI child processes are user-commanded build, package-manager, or Vercel operations.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,195 file(s), 10.3 MB of source, external domains: 127.0.0.1, adaptivecards.io, ai-gateway.vercel.sh, ai.google.dev, ai.todoist.net, api-ssl.bitly.com, api.anthropic.com, api.botframework.com, api.brex.com, api.browser-use.com, api.github.com, api.linear.app, api.notion.com, api.openai.com, api.oreilly.com, api.telegram.org, api.twilio.com, api.vercel.com, app.photon.codes, asset-management.mcp.cloudinary.com, auth.openai.com, chatgpt.com, coda.io, connect.vercel.com, developers.notion.com, discord.com, docs.cloud.google.com, docs.slack.dev, eve.dev, eve.local, example.com, generativelanguage.googleapis.com, github.com, google.aip.dev, huggingface.co, json-schema.org, json.schemastore.org, login.botframework.com, login.microsoftonline.com, mcp-server.egnyte.com, mcp-server.zomato.com, mcp.airtable.com, mcp.candid.org, mcp.clickhouse.cloud, mcp.datadoghq.com, mcp.honeycomb.io, mcp.linear.app, mcp.localfalcon.com, mcp.make.com, mcp.manufact.com

Oversized source lightweight scan

dist/src/compiled/@photon-ai/chat-adapter-imessage/index.js2.31 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsHighEntropyStringsMinified

dist/src/compiled/shadcn-registry/index.js9.24 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsMinifiedUrlStringsui.shadcn.com

Source & flagged code

13 flagged · loading source

bin/eve.jsView file

2L3: import { spawn } from "node:child_process"; L4: import { access, readdir, realpath, stat } from "node:fs/promises";

High

Child Process

Package source references child process execution.

bin/eve.jsView on unpkg · L2

8L9: const require = createRequire(import.meta.url); L10: const packageJson = require("../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/eve.jsView on unpkg · L8

dist/src/compiled/gray-matter/index.jsView file

43return `+str.trim()+`; L44: }());`),eval(str)||{}}catch(e){if(wrap!==!1&&/(unexpected|identifier)/i.test(e.message))return parse(str,options,!1);throw SyntaxError(e)}},stringify:function(){throw Error(`string... L45: `?e:e+`

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/compiled/gray-matter/index.jsView on unpkg · L43

dist/src/compiled/@workflow/core/runtime.jsView file

1import{i as e,o as t,t as n}from"../../_chunks/workflow/rolldown-runtime-DaDcL9Zw.js";import{$ as r,$n as i,$t as a,At as o,B as s,Bt as c,C as l,Cn as u,Ct as d,D as f,Dt as p,E a... L2: `).map(e=>{let n=e.match(/^\s*at\s+(?:(.+?)\s+\()?(.+?):(\d+):(\d+)\)?$/);if(!n)return e;let[,i,a,o,s]=n;if(!a.includes(t))return e;let c=parseInt(o,10),l=parseInt(s,10),u=ha(r,{li...

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/src/compiled/@workflow/core/runtime.jsView on unpkg · L1

dist/src/internal/authored-module-loader.jsView file

3`).filter(e=>!e.startsWith(`//#region `)&&e!==`//#endregion`).join(` L4: `)}async function loadBundledAuthoredModule(t,a){let s=await bundleAuthoredModuleCode(t,a),c=normalizeExternalDependencies(a.externalDependencies),l=createHash(`sha1`).update(t).up...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/internal/authored-module-loader.jsView on unpkg · L3

dist/src/internal/nitro/host/start-production-server.jsView file

1import{EVE_HEALTH_ROUTE_PATH}from"#protocol/routes.js";import{loadDevelopmentEnvironmentFiles}from"#cli/dev/environment.js";import{existsSync}from"node:fs";import{join,resolve}from... L2: `))}async function terminate(e){e.exitCode!==null||e.killed||(e.kill(`SIGTERM`),await Promise.race([once(e,`exit`),setTimeout(2e4).then(()=>`timeout`)])===`timeout`&&e.exitCode===n...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/internal/nitro/host/start-production-server.jsView on unpkg · L1

dist/src/compiled/_chunks/workflow/token-util-DNwIAn_u.jsView file

1import{a as e,i as t,n,r,t as i}from"./rolldown-runtime-DaDcL9Zw.js";import{t as a}from"./signal-exit-C8vsI6zj.js";var o=i(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPrope... L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON.... L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),C=i(((e,n)=>{let r=t(`path`),i=p(),a=e=>{e=... L4: `);return _?(a.originalMessage=a.message,a.message=y):a=Error(y),a.shortMessage=v,a.command=c,a.escapedCommand=l,a.exitCode=s,a.signal=o,a.signalDescription=m,a.stdout=e,a.stderr=t... L5: `)}var At,jt,V,Mt=n((()=>{we(),B(),At=(e,t)=

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/src/compiled/_chunks/workflow/token-util-DNwIAn_u.jsView on unpkg · L1

1import{a as e,i as t,n,r,t as i}from"./rolldown-runtime-DaDcL9Zw.js";import{t as a}from"./signal-exit-C8vsI6zj.js";var o=i(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPrope... L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON.... L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),C=i(((e,n)=>{let r=t(`path`),i=p(),a=e=>{e=... L4: `);return _?(a.originalMessage=a.message,a.message=y):a=Error(y),a.shortMessage=v,a.command=c,a.escapedCommand=l,a.exitCode=s,a.signal=o,a.signalDescription=m,a.stdout=e,a.stderr=t... L5: `)}var At,jt,V,Mt=n((()=>{we(),B(),At=(e,t)=

High

Command Output Exfiltration

dist/src/compiled/@vercel/sandbox/index.jsView file

1import{i as e,o as t,t as n}from"../../_chunks/node/rolldown-runtime-DaDcL9Zw.js";import{n as r,t as i}from"../../_chunks/node/dist-DsNhwdzf.js";import{n as a,t as o}from"../../_ch... L2: `)),e.linkname&&(n+=y(` linkpath=`+e.linkname+` ... L6: `)},n.exports=i})),_t=n((e=>{var t=ht();gt(),e.parse=function(e){return new t(e)}})),vt=n(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=Object.getOwnProp... L7: ${e.message}`),t?new f.VercelOidcTokenError(t):e}return n}function m(){let e=(0,d.getContext)().headers?.[`x-vercel-oidc-token`]??process.env.VERCEL_OIDC_TOKEN;if(!e)throw Error(`T... L8: `):t;let n=t.replace(/^/gm,`${kt} `);console.error(Ot[e](n))}function At(e){return F.default.italic(F.default.dim("`")+e+F.default.dim("`"))}var jt=t(a(),1);async function Mt()

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/compiled/@vercel/sandbox/index.jsView on unpkg · L1

dist/src/compiled/_chunks/workflow/dist-CZxNEvEs.jsView file

1var e=`vercel.ai.error`,t=Symbol.for(e),n,r,i=class i extends (r=Error,n=t,r){constructor({name:e,message:t,cause:r}){super(t),this[n]=!0,this.name=e,this.cause=r}static isInstance... L2: Error message: ${ne(t)}`,cause:t}),this[we]=!0,this.text=e}static isInstance(e){return i.hasMarker(e,Se)}},De=`AI_LoadAPIKeyError`,Oe=`vercel.ai.error.${De}`,ke=Symbol.for(Oe),Ae,j... ... L4: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ... L5: `))}};const sr={major:4,minor:4,patch:3},w=h(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=sr;let r=[...e._zod.def.checks??[]];e._zod.traits... L6: if (${n}.issues.length) { ... L74: ${i}`

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/src/compiled/_chunks/workflow/dist-CZxNEvEs.jsView on unpkg · L1

dist/src/compiled/shadcn-registry/index.jsView file

•path = dist/src/compiled/shadcn-registry/index.js kind = oversized_source_file sizeBytes = 9684263 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/src/compiled/shadcn-registry/index.jsView on unpkg

dist/src/compiled/@photon-ai/chat-adapter-imessage/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/compiled/@photon-ai/chat-adapter-imessage/index.jsView on unpkg

dist/src/runtime/connections/mcp-client.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = eve@0.31.2 matchedIdentity = npm:ZXZl:0.31.2 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/runtime/connections/mcp-client.jsView on unpkg

Source & flagged code

13 flagged

bin/eve.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2

3import { spawn } from "node:child_process";

4import { access, readdir, realpath, stat } from "node:fs/promises";

High

Child Process

Package source references child process execution.

bin/eve.jsView on unpkg · L2

5import { createRequire } from "node:module";

6import { dirname, resolve } from "node:path";

7import { fileURLToPath, pathToFileURL } from "node:url";

8

9const require = createRequire(import.meta.url);

10const packageJson = require("../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/eve.jsView on unpkg · L8

11const packageNodeEngine = packageJson.engines?.node;

12const bootstrapPackageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");

13let semverPromise;

14

15if (typeof packageNodeEngine !== "string") {

16 throw new Error("eve package.json must declare a valid engines.node range.");

17}

18

19function createBootstrapOptions(overrides = {}) {

20 const packageRoot = overrides.packageRoot ?? bootstrapPackageRoot;

21

22 return {

23 cliEntrypointPath:

24 overrides.cliEntrypointPath ?? resolve(packageRoot, "dist", "src", "cli", "run.js"),

25 packageRoot,

26 postBuildScriptPaths: overrides.postBuildScriptPaths ?? [

27 resolve(packageRoot, "scripts", "copy-compiled-assets.mjs"),

28 resolve(packageRoot, "scripts", "copy-runtime-assets.mjs"),

dist/src/compiled/gray-matter/index.jsView file

Lines 23-48javascript

23`,o?1+l:l)):u?(u=!1,e.result+=n.repeat(`

24`,l+1)):l===0?o&&(e.result+=` `):e.result+=n.repeat(`

25`,l):e.result+=n.repeat(`

26`,o?1+l:l),o=!0,s=!0,l=0,r=e.position;!x(h)&&h!==0;)h=e.input.charCodeAt(++e.position);I(e,r,e.position,!1)}return!0}function J(e,t){var n,r=e.tag,i=e.anchor,a=[],o,s=!1,c;for(e.anchor!==null&&(e.anchorMap[e.anchor]=a),c=e.input.charCodeAt(e.position);c!==0&&!(c!==45||(o=e.input.charCodeAt(e.position+1),!C(o)));){if(s=!0,e.position++,B(e,!0,-1)&&e.lineIndent<=t){a.push(null),c=e.input.charCodeAt(e.position);continue}if(n=e.line,Z(e,t,u,!1,!0),a.push(e.result),B(e,!0,-1),c=e.input.charCodeAt(e.position),(e.line===n||e.lineIndent>t)&&c!==0)N(e,`bad indentation of a sequence entry`);else if(e.lin ...

27`),e.charCodeAt(

dist/src/compiled/@workflow/core/runtime.jsView file

Lines 1-3javascript

1import{i as e,o as t,t as n}from"../../_chunks/workflow/rolldown-runtime-DaDcL9Zw.js";import{$ as r,$n as i,$t as a,At as o,B as s,Bt as c,C as l,Cn as u,Ct as d,D as f,Dt as

dist/src/internal/authored-module-loader.jsView file

Lines 1-4javascript

1import{createHash}from"node:crypto";import{expectObjectRecord}from"#internal/authored-module.js";import{existsSync,mkdirSync,writeFileSync}from"node:fs";import{dirname,join,resolve}from"node:path";import{createCompiledModuleMapSource}from"#compiler/module-map.js";import

dist/src/internal/nitro/host/start-production-server.jsView file

Lines 1-3javascript

1import{EVE_HEALTH_ROUTE_PATH}from"#protocol/routes.js";import{loadDevelopmentEnvironmentFiles}from"#cli/dev/environment.js";import{existsSync}from"node:fs";import{join,resolve}from"node:path";import{spawn}from"node:child_process";import

dist/src/compiled/_chunks/workflow/token-util-DNwIAn_u.jsView file

Lines 1-21javascript

1import{a as e,i as t,n,r,t as i}from"./rolldown-runtime-DaDcL9Zw.js";import{t as a}from"./signal-exit-C8vsI6zj.js";var o=i(((e,t)

dist/src/compiled/@vercel/sandbox/index.jsView file

1import{i as e,o as t,t as n}from"../../_chunks/node/rolldown-runtime-DaDcL9Zw.js";import{n as r,t as i}from"../../_chunks/node/dist-DsNhwdzf.js";import{n as a,t as o}from"../../_ch... L2: `)),e.linkname&&(n+=y(` linkpath=`+e.linkname+` ... L6: `)},n.exports=i})),_t=n((e=>{var t=ht();gt(),e.parse=function(e){return new t(e)}})),vt=n(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=Object.getOwnProp... L7: ${e.message}`),t?new f.VercelOidcTokenError(t):e}return n}function m(){let e=(0,d.getContext)().headers?.[`x-vercel-oidc-token`]??process.env.VERCEL_OIDC_TOKEN;if(!e)throw Error(`T... L8: `):t;let n=t.replace(/^/gm,`${kt} `);console.error(Ot[e](n))}function At(e){return F.default.italic(F.default.dim("`")+e+F.default.dim("`"))}var jt=t(a(),1);async function Mt()

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/compiled/@vercel/sandbox/index.jsView on unpkg · L1

dist/src/compiled/_chunks/workflow/dist-CZxNEvEs.jsView file

1var e=`vercel.ai.error`,t=Symbol.for(e),n,r,i=class i extends (r=Error,n=t,r){constructor({name:e,message:t,cause:r}){super(t),this[n]=!0,this.name=e,this.cause=r}static isInstance... L2: Error message: ${ne(t)}`,cause:t}),this[we]=!0,this.text=e}static isInstance(e){return i.hasMarker(e,Se)}},De=`AI_LoadAPIKeyError`,Oe=`vercel.ai.error.${De}`,ke=Symbol.for(Oe),Ae,j... ... L4: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ... L5: `))}};const sr={major:4,minor:4,patch:3},w=h(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=sr;let r=[...e._zod.def.checks??[]];e._zod.traits... L6: if (${n}.issues.length) { ... L74: ${i}`

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/src/compiled/_chunks/workflow/dist-CZxNEvEs.jsView on unpkg · L1

dist/src/compiled/shadcn-registry/index.jsView file

•path = dist/src/compiled/shadcn-registry/index.js kind = oversized_source_file sizeBytes = 9684263 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/src/compiled/shadcn-registry/index.jsView on unpkg

dist/src/compiled/@photon-ai/chat-adapter-imessage/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/compiled/@photon-ai/chat-adapter-imessage/index.jsView on unpkg

dist/src/runtime/connections/mcp-client.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = eve@0.31.2 matchedIdentity = npm:ZXZl:0.31.2 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/runtime/connections/mcp-client.jsView on unpkg