Filesystem-first framework for durable backend AI agents that run anywhere.
AI Security Review
scanned 1mo ago · by lpm-firewall-ai
Inspected source is the Vercel eve agent framework: no install lifecycle hooks, and scanner-hot files are vendored OIDC, OpenTelemetry, HTTP basic auth, and CLI helpers. A clean verdict cannot be finalized because eleven required citation paths exceed the eight-citation limit, and no independent source behavior supports a warning or block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
npm install does not run package scripts; the eve CLI or an app import must be used.
Impact
No confirmed covert impact from install or hidden import-time code.
Mechanism
No confirmed malicious mechanism; remaining gap is citation capacity for a clean verdict.
AI rationale
Inspected source is the Vercel eve agent framework: no install lifecycle hooks, and scanner-hot files are vendored OIDC, OpenTelemetry, HTTP basic auth, and CLI helpers. A clean verdict cannot be finalized because eleven required citation paths exceed the eight-citation limit, and no independent source behavior supports a warning or block.
Decision evidence
public snapshot
AI called this Manual Review at 84.0% confidence as Unknown with high false-positive risk.
AI review observations
package.json names eve 0.44.4 as a Vercel agent framework, exposes an eve CLI, and lists only build and test scripts with no install lifecycle hooks.
bin/eve.js starts the compiled CLI only when that file is invoked directly as the eve command.
The host-fingerprint hit is a Vercel OIDC User-Agent that includes hostname and fetches OpenID config from vercel.com.
http-basic.js only compares an HTTP Basic header to a configured username and password.
run-vercel.js spawns a local Vercel CLI, and start-production-server.js launches a previously built local Nitro server.
@vercel/otel loads platform machine-id helpers used for OpenTelemetry resource detection.
Evidence against
The scanner matched this tree to a previously flagged eve package and reported host fingerprinting in a bundled workflow chunk.
The product is a dual-use agent runtime with spawn, sandbox, MCP, and network APIs after a user runs the CLI or deploys an app.
Several vendored compiled files are too large for full AST coverage.
1import{a as e,i as t,t as n}from"../../_chunks/workflow/rolldown-runtime-8V8biNmG.js";import{$ as r,$n as i,$t as a,A as o,An as s,Ar as c,At as l,B as u,Bn as d,Bt as f,C as p,Cn ...
L2: `).map(e=>{let n=e.match(/^\s*at\s+(?:(.+?)\s+\()?(.+?):(\d+):(\d+)\)?$/);if(!n)return e;let[,i,a,o,s]=n;if(!a.includes(t))return e;let c=parseInt(o,10),l=parseInt(s,10),u=Ka(r,{li...
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
1import{i as e,o as t,t as n}from"../../_chunks/node/rolldown-runtime-DaDcL9Zw.js";import{n as r,t as i}from"../../_chunks/node/dist-DsNhwdzf.js";import{n as a,t as o}from"../../_ch...
L2: `)),e.linkname&&(n+=y(` linkpath=`+e.linkname+`
...
L6: `)},n.exports=i})),xt=n((e=>{var t=yt();bt(),e.parse=function(e){return new t(e)}})),St=n(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=Object.getOwnProp...
L7: ${e.message}`),t?new f.VercelOidcTokenError(t):e}return n}function m(){let e=(0,d.getContext)().headers?.[`x-vercel-oidc-token`]??process.env.VERCEL_OIDC_TOKEN;if(!e)throw Error(`T...
L8: `):t;let n=t.replace(/^/gm,`${Nt} `);console.error(Mt[e](n))}function Pt(e){return F.default.italic(F.default.dim("`")+e+F.default.dim("`"))}var Ft=t(a(),1);async function It()
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
1import{AISDKError as e,APICallError as t,EmptyResponseBodyError as n,InvalidArgumentError as r,InvalidResponseDataError as i,JSONParseError as a,LoadAPIKeyError as o,NoSuchProvider...
L2: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ...
L3: `))}};const It={major:4,minor:4,patch:3},N=p(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=It;let r=[...e._zod.def.checks??[]];e._zod.traits...
L4: if (${n}.issues.length) {
...
L72: ${i}`,d++;return}if(es(e,t,r)){f=e.slice(e.charCodeAt(t+6)===32?t+7:t+6,n)||void 0;return}if(r===105&&e.charCodeAt(t+1)===100&&e.charCodeAt(t+2)===58){let r=e.slice(e.charCodeAt(t+...
L73: ${t}`,d+
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
26`,o?1+l:l),o=!0,s=!0,l=0,r=e.position;!x(h)&&h!==0;)h=e.input.charCodeAt(++e.position);I(e,r,e.position,!1)}return!0}function J(e,t){var n,r=e.tag,i=e.anchor,a=[],o,s=!1,c;for(e.anchor!==null&&(e.anchorMap[e.anchor]=a),c=e.input.charCodeAt(e.position);c!==0&&!(c!==45||(o=e.input.charCodeAt(e.position+1),!C(o)));){if(s=!0,e.position++,B(e,!0,-1)&&e.lineIndent<=t){a.push(null),c=e.input.charCodeAt(e.position);continue}if(n=e.line,Z(e,t,u,!1,!0),a.push(e.result),B(e,!0,-1),c=e.input.charCodeAt(e.position),(e.line===n||e.lineIndent>t)&&c!==0)N(e,`bad indentation of a sequence entry`);else if(e.lin ...
1import{a as e,i as t,t as n}from"../../_chunks/workflow/rolldown-runtime-8V8biNmG.js";import{$ as r,$n as i,$t as a,A as o,An as s,Ar as c,At as l,B as u,Bn as d,Bt as f,C as
1import{i as e,o as t,t as n}from"../../_chunks/node/rolldown-runtime-DaDcL9Zw.js";import{n as r,t as i}from"../../_chunks/node/dist-DsNhwdzf.js";import{n as a,t as o}from"../../_ch...
L2: `)),e.linkname&&(n+=y(` linkpath=`+e.linkname+`
...
L6: `)},n.exports=i})),xt=n((e=>{var t=yt();bt(),e.parse=function(e){return new t(e)}})),St=n(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=Object.getOwnProp...
L7: ${e.message}`),t?new f.VercelOidcTokenError(t):e}return n}function m(){let e=(0,d.getContext)().headers?.[`x-vercel-oidc-token`]??process.env.VERCEL_OIDC_TOKEN;if(!e)throw Error(`T...
L8: `):t;let n=t.replace(/^/gm,`${Nt} `);console.error(Mt[e](n))}function Pt(e){return F.default.italic(F.default.dim("`")+e+F.default.dim("`"))}var Ft=t(a(),1);async function It()
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
1import{AISDKError as e,APICallError as t,EmptyResponseBodyError as n,InvalidArgumentError as r,InvalidResponseDataError as i,JSONParseError as a,LoadAPIKeyError as o,NoSuchProvider...
L2: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ...
L3: `))}};const It={major:4,minor:4,patch:3},N=p(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=It;let r=[...e._zod.def.checks??[]];e._zod.traits...
L4: if (${n}.issues.length) {
...
L72: ${i}`,d++;return}if(es(e,t,r)){f=e.slice(e.charCodeAt(t+6)===32?t+7:t+6,n)||void 0;return}if(r===105&&e.charCodeAt(t+1)===100&&e.charCodeAt(t+2)===58){let r=e.slice(e.charCodeAt(t+...
L73: ${t}`,d+
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
42`:``}function pe(e,t){return fe(e,n.extend({schema:a},t))}t.exports.dump=fe,t.exports.safeDump=pe})),require_js_yaml$1=__commonJSMin(((e,t)=>{var n=require_loader(),r=require_dumper();function i(e){return function(){throw Error(`Function `+e+` is deprecated and cannot be used.`)}}t.exports.Type=require_type(),t.exports.Schema=require_schema(),t.exports.FAILSAFE_SCHEMA=require_failsafe(),t.exports.JSON_SCHEMA=require_json(),t.exports.CORE_SCHEMA=require_core(),t.exports.DEFAULT_SAFE_SCHEMA=require_default_safe(),t.exports.DEFAULT_FULL_SCHEMA=require_default_full(),t.exports.load=n.load,t.export ...
43return `+str.trim()+`;
44}());`),eval(str)||{}}catch(e){if(wrap!==!1&&/(unexpected|identifier)/i.test(e.message))returnparse(str,options,!1);throwSyntaxError(e)}},stringify:function(){throwError(`stringifying JavaScript is not supported`)}}})),require_strip_bom_string=__commonJSMin(((e,t)=>{t.exports=function(e){returntypeof e==`string`&&e.charAt(0)===``?e.slice(1):e}})),require_utils=__commonJSMin((e=>{let t=require_strip_bom_string(),n=require_kind_of();e.define=function(e,t,n){Reflect.defineProperty(e,t,{enumerable:!1,configurable:!0,writable:!0,value:n})},e.isBuffer=function(e){returnn(e)===`buffer`},e.isObj ...
45`?e:e+`
Low
Eval
Package source references a known benign dynamic code generation pattern.
2`))}async function terminate(e){e.exitCode!==null||e.killed||(e.kill(`SIGTERM`),await Promise.race([once(e,`exit`),setTimeout(2e4).then(()=>`timeout`)])===`timeout`&&e.exitCode===null&&(e.kill(`SIGKILL`),await once(e,`exit`)),e.stdout?.destroy(),e.stderr?.destroy())}function once(e,t){return new Promise(n=>{e.once(t,()=>n())})}async function startProductionServer(e,n={}){let o=resolve(e),s=resolveOutputServerEntry(o);if(!existsSync(s))throw Error(`Missing eve build output at ${s}. Run "eve build" before "eve start".`);loadDevelopmentEnvironmentFiles(o),await prewarmBuiltAppSandboxes({appRoot:o ...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/src/internal/nitro/host/start-production-server.jsView on unpkg · L1
3`)))})});h.catch(()=>void0);try{return{asyncclose(){f=!0,awaitterminate(m)},url:awaitwaitForReady({child:m,getStartError:()=>p,getOutput:()=>d,knownUrl:u}),asyncwait(){await h}}}catch(e){throw f=!0,awaitterminate(m),isRecord(e)&&e.name===`AbortError`?Error(`Timed out waiting for built eve server to respond.`,{cause:e}):e}}export{startProductionServer};
Long lines were clipped for display.
Object.defineProperty,r
=
Object.getOwnPropertyDescriptor,i
=
Object.getOwnPropertyNames,a
=
Object
.
prototype
.hasOwnProperty,
o
=
(
e
,
t
)
=>
{
for
(
var
r
in
t)
n
(e,r,{get:t[r],enumerable:
!
0
})},
s
=
(
e
,
t
,
o
,
s
)
=>
{
if
(t
&&typeof
t
==
`object`
||typeof
t
==
`function`
)
for
(
let
c
of
i
(t))
!
a.
call
(e,c)
&&
c
!==
o
&&
n
(e,c,{
get
:()
=>
t[c],enumerable:
!
(s
=
r
(t,c))
||
s.enumerable});
return
e},
c
=
e
=>
s
(
n
({},
`__esModule`
,{value:
!
0
}),e),l
=
{};
o
(l,{
VercelOidcTokenError
:()
=>
u}),t.exports
=
c
(l);
var
u
=class
extends
Error
{
constructor
( ...
2`)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`notadirectory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Workingdirectory${JSON.stringify(e)} doesnotexistorisnota directory.`})}}function h(e,t){if(typeof t==`object`&&t){let n=t;if(n.code===`ENOENT`)return new f({code:`VERCEL_CLI_NOT_FOUND`,message:`UnabletofindVercelCLIcommand${JSON.stringify(e.command)}.`,invocation:e,cause:t});if(n.code===`EACCES`||n.code===`EPERM`)return new f({code:`VERCEL_CLI_PERMISSION_DENIED`,message:`PermissiondeniedwhileexecutingVercelCLIcommand${J ...
4`);return _?(a.originalMessage=a.message,a.message=y):a=Error(y),a.shortMessage=v,a.command=c,a.escapedCommand=l,a.exitCode=s,a.signal=o,a.signalDescription=m,a.stdout=e,a.stderr=t,i!==void 0&&(a.all=i),`bufferedData`in a&&delete a.bufferedData,a.failed=!0,a.timedOut=!!u,a.isCanceled=d,a.killed=f&&!u,a}})),O=t(((e,t)=>{let n=[`stdin`,`stdout`,`stderr`],r=e=>n.some(t=>e[t]!==void 0),i=e=>{if(!e)return;let{stdio:t}=e;if(t===void 0)return n.map(t=>e[t]);if(r(e))throw Error(`It's not possible to provide \`stdio\` in combination with one of ${n.map(e=>`\`${e}\``).join(`, `)}`);if(typeof t==`string` ...
5`)}})),q=t((e=>{var t=e&&e.__createBinding||(Object.create?(function(e,t,n,r){r===void 0&&(r=n);var i=Object.getOwnPropertyDescriptor(t,n);(!i||(`get`in i?!t.__esModule:i.writable||i.configurable))&&(i={enumerable:!0,get:function(){return t[n]}}),Object.defineProperty(e,r,i)}):(function(e,t,n,r){r===void 0&&(r=n),e[r]=t[n]})),n=e&&e.__setModuleDefault||(Object.create?(function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}):function(e,t){e.default=t}),r=e&&e.__importStar||function(e){if(e&&e.__esModule)return e;var r={};if(e!=null)for(var i in e)i!=="default"&&Object.prototyp ...