registry / eve / 0.45.0

eve@0.45.0

Filesystem-first framework for durable backend AI agents that run anywhere.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Inspected source is the Vercel eve agent framework with no install lifecycle, but user-invoked process spawn, sandbox, and OIDC clients plus oversized compiled bundles could not be fully cited or traced. Residual dual-use risk is a warning, not a block, because no covert install-time mutation or unrelated exfil sink was found.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A user runs the eve CLI or imports framework adapters; npm install does not run lifecycle scripts.

Impact

Process spawn and credentialed calls to Vercel or channel APIs if the product is used; no confirmed install-time compromise.

Mechanism

User-invoked dual-use agent CLI, sandbox, and credentialed Vercel clients

AI rationale

Evidence

bin/eve.jsdist/src/compiled/_chunks/workflow/token-util-BneBe0g5.jsdist/src/compiled/@vercel/sandbox/index.jsdist/src/public/next/server.jsdist/src/public/models/openai/chatgpt/unsigned-jwt.jsdist/src/cli/run.js

Network endpoints3

vercel.com/.well-known/openid-configurationvercel.com/apiapi.linqapp.com/api/partner

Decision evidence

public snapshot

AI called this Suspicious at 70.0% confidence as Dangerous Capability with high false-positive risk.

Evidence for warning

package.json has no preinstall, install, or postinstall scripts; published scripts are build and test only, and runtime dependencies are only nitro and undici.
The eve CLI runs only on direct invocation and can spawn a local rebuild; Next, Nuxt, and SvelteKit adapters spawn that same local eve binary for development servers.
Vendored OIDC code puts os.hostname() into a User-Agent and fetches OpenID discovery on vercel.com; vendored sandbox talks to vercel.com/api with Vercel tokens.
createUnsignedJwt builds alg-none tokens, and large compiled Linq, Photon, OTEL, and workflow bundles exceeded scanner analysis limits, so dual-use paths were not fully traced.
High similarity hits are first-party OpenTelemetry, local-dev spawners, a Vercel CLI runner, and inbound HTTP basic or OIDC channel auth, not install-time mutation.

Evidence against

The manifest identifies this as the Apache-2.0 Vercel eve agent framework at github.com/vercel/eve.
historical-eve-0-30-8 is a devDependency alias only, so the runtime self-dependency install-hook rule does not apply.
Observed hosts (vercel.com, oidc.vercel.com, api.linqapp.com) match first-party product integrations rather than a hidden recipient.

Source & flagged code

21 flagged

bin/eve.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

3import { spawn } from "node:child_process";

4import { access, readdir, realpath, stat } from "node:fs/promises";

High

Child Process

Package source references child process execution.

bin/eve.jsView on unpkg · L2

5import { createRequire } from "node:module";

6import { dirname, resolve } from "node:path";

7import { fileURLToPath, pathToFileURL } from "node:url";

9const require = createRequire(import.meta.url);

10const packageJson = require("../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/eve.jsView on unpkg · L8

11const packageNodeEngine = packageJson.engines?.node;

12const bootstrapPackageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");

13let semverPromise;

15if (typeof packageNodeEngine !== "string") {

16 throw new Error("eve package.json must declare a valid engines.node range.");

17}

19function createBootstrapOptions(overrides = {}) {

20 const packageRoot = overrides.packageRoot ?? bootstrapPackageRoot;

22 return {

23 cliEntrypointPath:

24 overrides.cliEntrypointPath ?? resolve(packageRoot, "dist", "src", "cli", "run.js"),

25 packageRoot,

26 postBuildScriptPaths: overrides.postBuildScriptPaths ?? [

27 resolve(packageRoot, "scripts", "copy-compiled-assets.mjs"),

28 resolve(packageRoot, "scripts", "copy-runtime-assets.mjs"),

2Cross-file remote execution chain: bin/eve.js spawns dist/src/compiled/@agentclientprotocol/sdk/index.js; helper contains network access plus dynamic code execution. L2: L3: import { spawn } from "node:child_process"; L4: import { access, readdir, realpath, stat } from "node:fs/promises"; ... L9: const require = createRequire(import.meta.url); L10: const packageJson = require("../package.json"); L11: const packageNodeEngine = packageJson.engines?.node; ... L350: } L351: process.exitCode = 1; L352: } finally {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/eve.jsView on unpkg · L2

dist/src/compiled/gray-matter/index.jsView file

43return `+str.trim()+`; L44: }());`),eval(str)||{}}catch(e){if(wrap!==!1&&/(unexpected|identifier)/i.test(e.message))return parse(str,options,!1);throw SyntaxError(e)}},stringify:function(){throw Error(`string... L45: `?e:e+`

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/compiled/gray-matter/index.jsView on unpkg · L43

dist/src/compiled/@workflow/core/runtime.jsView file

1import{a as e,i as t,t as n}from"../../_chunks/workflow/rolldown-runtime-8V8biNmG.js";import{$ as r,$n as i,$t as a,A as o,An as s,Ar as c,At as l,B as u,Bn as d,Bt as f,C as p,Cn ... L2: `).map(e=>{let n=e.match(/^\s*at\s+(?:(.+?)\s+$)?(.+?):(\d+):(\d+)$?$/);if(!n)return e;let[,i,a,o,s]=n;if(!a.includes(t))return e;let c=parseInt(o,10),l=parseInt(s,10),u=Ka(r,{li...

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/src/compiled/@workflow/core/runtime.jsView on unpkg · L1

dist/src/internal/authored-module-loader.jsView file

Lines 1-4javascript

1import{createHash}from"node:crypto";import{expectObjectRecord}from"#internal/authored-module.js";import{dirname,join,resolve}from"node:path";import{existsSync,mkdirSync,realpathSync,writeFileSync}from"node:fs";import{createCompiledModuleMapSource}from"#compiler/module-map.js";import

dist/src/compiled/_chunks/workflow/token-util-BneBe0g5.jsView file

1import{i as e,t}from"./rolldown-runtime-8V8biNmG.js";import{t as n}from"./signal-exit-o3IPQwwv.js";var r=t(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=... L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON.... L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),b=t(((t,n)=>{let r=e(`path`),i=u(),a=e=>{e=... ... L6: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ... L7: `))}}})),re=t((e=>{Object.defineProperty

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/compiled/_chunks/workflow/token-util-BneBe0g5.jsView on unpkg · L1

1import{i as e,t}from"./rolldown-runtime-8V8biNmG.js";import{t as n}from"./signal-exit-o3IPQwwv.js";var r=t(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=... L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON.... L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),b=t(((t,n)=>{let r=e(`path`),i=u(),a=e=>{e=... L4: `);return _?(a.originalMessage=a.message,a.message=y):a=Error(y),a.shortMessage=v,a.command=c,a.escapedCommand=l,a.exitCode=s,a.signal=o,a.signalDescription=m,a.stdout=e,a.stderr=t... L5: `)}})),q=t((e=>{var t=e&&e.__createBinding||

High

dist/src/compiled/@vercel/sandbox/index.jsView file

1import{i as e,o as t,t as n}from"../../_chunks/node/rolldown-runtime-DaDcL9Zw.js";import{n as r,t as i}from"../../_chunks/node/dist-DsNhwdzf.js";import{n as a,t as o}from"../../_ch... L2: `)),e.linkname&&(n+=y(` linkpath=`+e.linkname+` ... L6: `)},n.exports=i})),xt=n((e=>{var t=yt();bt(),e.parse=function(e){return new t(e)}})),St=n(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=Object.getOwnProp... L7: ${e.message}`),t?new f.VercelOidcTokenError(t):e}return n}function m(){let e=(0,d.getContext)().headers?.[`x-vercel-oidc-token`]??process.env.VERCEL_OIDC_TOKEN;if(!e)throw Error(`T... L8: `):t;let n=t.replace(/^/gm,`${Nt} `);console.error(Mt[e](n))}function Pt(e){return F.default.italic(F.default.dim("`")+e+F.default.dim("`"))}var Ft=t(a(),1);async function It()

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/compiled/@vercel/sandbox/index.jsView on unpkg · L1

dist/src/compiled/_chunks/workflow/dist-eUxFublw.jsView file

1import{AISDKError as e,APICallError as t,EmptyResponseBodyError as n,InvalidArgumentError as r,InvalidResponseDataError as i,JSONParseError as a,LoadAPIKeyError as o,NoSuchProvider... L2: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ... L3: `))}};const It={major:4,minor:4,patch:3},N=p(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=It;let r=[...e._zod.def.checks??[]];e._zod.traits... L4: if (${n}.issues.length) { ... L72: ${i}`,d++;return}if(es(e,t,r)){f=e.slice(e.charCodeAt(t+6)===32?t+7:t+6,n)||void 0;return}if(r===105&&e.charCodeAt(t+1)===100&&e.charCodeAt(t+2)===58){let r=e.slice(e.charCodeAt(t+... L73: ${t}`,d+

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/src/compiled/_chunks/workflow/dist-eUxFublw.jsView on unpkg · L1

dist/src/compiled/@vercel/oidc/index.jsView file

1Trigger-reachable command-output exfiltration chain: manifest.exports -> dist/src/public/agents/auth.js -> dist/src/compiled/@vercel/oidc/index.js L1: import{createRequire as e}from"node:module";var t=Object.create,n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=Object.getOwnPropertyNames,a=Object.getPrototypeOf,o=Obj... L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON.... L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),j=s(((e,t)=>{let n=u(`path`),r=x(),i=e=>{e=...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/src/compiled/@vercel/oidc/index.jsView on unpkg · L1

dist/src/compiled/shadcn-registry/index.jsView file

•path = dist/src/compiled/shadcn-registry/index.js kind = oversized_source_file sizeBytes = 9760341 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/src/compiled/shadcn-registry/index.jsView on unpkg

dist/src/compiled/@linqapp/chat-sdk-adapter/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/compiled/@linqapp/chat-sdk-adapter/index.js#virtual:normalized:round1View on unpkg

dist/src/compiled/@vercel/otel/index.jsView file

•matchType = normalized_sha256 matchedPackage = eve@0.51.0 matchedPath = dist/src/compiled/@vercel/otel/index.js matchedIdentity = npm:ZXZl:0.51.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High