Filesystem-first framework for durable backend AI agents that run anywhere.
AI Security Review
scanned 1mo ago · by lpm-firewall-ai
The source does not establish malicious intent or an automatic compromise path, but it bundles credential-bearing Vercel workflow code and configurable authenticated networking. Treat this as an unresolved runtime risk rather than publish-blocking malware.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Application runtime calls Vercel workflow or authenticated client features.
Impact
A Vercel token and host identity may be disclosed to Vercel; caller-configured client hosts receive authenticated requests.
Mechanism
Vercel token refresh and authenticated network requests.
AI rationale
The source does not establish malicious intent or an automatic compromise path, but it bundles credential-bearing Vercel workflow code and configurable authenticated networking. Treat this as an unresolved runtime risk rather than publish-blocking malware.
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/src/compiled/@vercel/blob/index.js:
Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let t of this.seen.entries()){let r=t[1];if(e===t[0]){a(t);continue}if(n.external){let r=n.ex...
${n}`.trim()),new y.VercelOidcTokenError(t?`Failed to refresh OIDC token with the Vercel CLI: ${t}`:`Failed to refresh OIDC token with the Vercel CLI`)}}async function E(e,t,n){let...
${e.message}`),t?new p.VercelOidcTokenError(t):e}return e?.audience&&(t=await(0,d.exchangeVercelOidcToken)({token:t,audience:e.audience,jti:e.jti,skipCache:e.skipCache})),t}0&&(t.e...
`)||e.includes(`\r`)||e.includes(`\0`))===!1}funct
1import{a as e,i as t,t as n}from"../../_chunks/workflow/rolldown-runtime-8V8biNmG.js";import{$ as r,$n as i,$t as a,A as o,An as s,Ar as c,At as l,B as u,Bn as d,Bt as f,C as p,Cn ...
L2: `).map(e=>{let n=e.match(/^\s*at\s+(?:(.+?)\s+\()?(.+?):(\d+):(\d+)\)?$/);if(!n)return e;let[,i,a,o,s]=n;if(!a.includes(t))return e;let c=parseInt(o,10),l=parseInt(s,10),u=Ka(r,{li...
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
1import{i as e,t}from"./rolldown-runtime-8V8biNmG.js";import{t as n}from"./signal-exit-o3IPQwwv.js";var r=t(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=...
L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON....
L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),b=t(((t,n)=>{let r=e(`path`),i=u(),a=e=>{e=...
...
L6: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ...
L7: `))}}})),re=t((e=>{Object.defineProperty
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/src/compiled/_chunks/workflow/token-util-BneBe0g5.jsView on unpkg · L1
1import{i as e,t}from"./rolldown-runtime-8V8biNmG.js";import{t as n}from"./signal-exit-o3IPQwwv.js";var r=t(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=...
L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON....
L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),b=t(((t,n)=>{let r=e(`path`),i=u(),a=e=>{e=...
L4: `);return _?(a.originalMessage=a.message,a.message=y):a=Error(y),a.shortMessage=v,a.command=c,a.escapedCommand=l,a.exitCode=s,a.signal=o,a.signalDescription=m,a.stdout=e,a.stderr=t...
L5: `)}})),q=t((e=>{var t=e&&e.__createBinding||
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
dist/src/compiled/_chunks/workflow/token-util-BneBe0g5.jsView on unpkg · L1
1import{i as e,t}from"./rolldown-runtime-8V8biNmG.js";import{t as n}from"./signal-exit-o3IPQwwv.js";var r=t(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=...
L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON....
L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),b=t(((t,n)=>{let r=e(`path`),i=u(),a=e=>{e=...
L4: `);return _?(a.originalMessage=a.message,a.message=y):a=Error(y),a.shortMessage=v,a.command=c,a.escapedCommand=l,a.exitCode=s,a.signal=o,a.signalDescription=m,a.stdout=e,a.stderr=t...
L5: `)}})),q=t((e=>{var t=e&&e.__createBinding||
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/src/compiled/_chunks/workflow/token-util-BneBe0g5.jsView on unpkg · L1
1import{i as e,o as t,t as n}from"../../_chunks/node/rolldown-runtime-DaDcL9Zw.js";import{n as r,t as i}from"../../_chunks/node/dist-DsNhwdzf.js";import{n as a,t as o}from"../../_ch...
L2: `)),e.linkname&&(n+=y(` linkpath=`+e.linkname+`
...
L6: `)},n.exports=i})),xt=n((e=>{var t=yt();bt(),e.parse=function(e){return new t(e)}})),St=n(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=Object.getOwnProp...
L7: ${e.message}`),t?new f.VercelOidcTokenError(t):e}return n}function m(){let e=(0,d.getContext)().headers?.[`x-vercel-oidc-token`]??process.env.VERCEL_OIDC_TOKEN;if(!e)throw Error(`T...
L8: `):t;let n=t.replace(/^/gm,`${Nt} `);console.error(Mt[e](n))}function Pt(e){return F.default.italic(F.default.dim("`")+e+F.default.dim("`"))}var Ft=t(a(),1);async function It()
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
1import{AISDKError as e,APICallError as t,EmptyResponseBodyError as n,InvalidArgumentError as r,InvalidResponseDataError as i,JSONParseError as a,LoadAPIKeyError as o,NoSuchProvider...
L2: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ...
L3: `))}};const It={major:4,minor:4,patch:3},N=p(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=It;let r=[...e._zod.def.checks??[]];e._zod.traits...
L4: if (${n}.issues.length) {
...
L72: ${i}`,d++;return}if(es(e,t,r)){f=e.slice(e.charCodeAt(t+6)===32?t+7:t+6,n)||void 0;return}if(r===105&&e.charCodeAt(t+1)===100&&e.charCodeAt(t+2)===58){let r=e.slice(e.charCodeAt(t+...
L73: ${t}`,d+
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/src/compiled/@vercel/blob/index.js:
Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let t of this.seen.entries()){let r=t[1];if(e===t[0]){a(t);continue}if(n.external){let r=n.ex...
${n}`.trim()),new y.VercelOidcTokenError(t?`Failed to refresh OIDC token with the Vercel CLI: ${t}`:`Failed to refresh OIDC token with the Vercel CLI`)}}async function E(e,t,n){let...
${e.message}`),t?new p.VercelOidcTokenError(t):e}return e?.audience&&(t=await(0,d.exchangeVercelOidcToken)({token:t,audience:e.audience,jti:e.jti,skipCache:e.skipCache})),t}0&&(t.e...
`)||e.includes(`\r`)||e.includes(`\0`))===!1}funct
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/src/compiled/@vercel/blob/index.jsView on unpkg
1Trigger-reachable command-output exfiltration chain: manifest.exports -> [redacted].d.ts -> [redacted]-blob.js -> dist/src/compiled/@vercel/blob/index.js
L1: import{createRequire as e}from"node:module";import{Readable as t}from"stream";var n=Object.create,r=Object.defineProperty,i=Object.getOwnPropertyDescriptor,a=Object.getOwnPropertyN...
L2: `)}async function m(e){try{if(!(await(0,u.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON....
L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),P=c(((e,t)=>{let n=d(`path`),r=w(),i=e=>{e=...
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
1import{a as e,i as t,t as n}from"../../_chunks/workflow/rolldown-runtime-8V8biNmG.js";import{$ as r,$n as i,$t as a,A as o,An as s,Ar as c,At as l,B as u,Bn as d,Bt as f,C as p,Cn ...
L2: `).map(e=>{let n=e.match(/^\s*at\s+(?:(.+?)\s+\()?(.+?):(\d+):(\d+)\)?$/);if(!n)return e;let[,i,a,o,s]=n;if(!a.includes(t))return e;let c=parseInt(o,10),l=parseInt(s,10),u=Ka(r,{li...
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
1import{i as e,t}from"./rolldown-runtime-8V8biNmG.js";import{t as n}from"./signal-exit-o3IPQwwv.js";var r=t(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=...
L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON....
L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),b=t(((t,n)=>{let r=e(`path`),i=u(),a=e=>{e=...
...
L6: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ...
L7: `))}}})),re=t((e=>{Object.defineProperty
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/src/compiled/_chunks/workflow/token-util-BneBe0g5.jsView on unpkg · L1
1import{i as e,t}from"./rolldown-runtime-8V8biNmG.js";import{t as n}from"./signal-exit-o3IPQwwv.js";var r=t(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=...
L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON....
L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),b=t(((t,n)=>{let r=e(`path`),i=u(),a=e=>{e=...
L4: `);return _?(a.originalMessage=a.message,a.message=y):a=Error(y),a.shortMessage=v,a.command=c,a.escapedCommand=l,a.exitCode=s,a.signal=o,a.signalDescription=m,a.stdout=e,a.stderr=t...
L5: `)}})),q=t((e=>{var t=e&&e.__createBinding||
1import{i as e,o as t,t as n}from"../../_chunks/node/rolldown-runtime-DaDcL9Zw.js";import{n as r,t as i}from"../../_chunks/node/dist-DsNhwdzf.js";import{n as a,t as o}from"../../_ch...
L2: `)),e.linkname&&(n+=y(` linkpath=`+e.linkname+`
...
L6: `)},n.exports=i})),xt=n((e=>{var t=yt();bt(),e.parse=function(e){return new t(e)}})),St=n(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=Object.getOwnProp...
L7: ${e.message}`),t?new f.VercelOidcTokenError(t):e}return n}function m(){let e=(0,d.getContext)().headers?.[`x-vercel-oidc-token`]??process.env.VERCEL_OIDC_TOKEN;if(!e)throw Error(`T...
L8: `):t;let n=t.replace(/^/gm,`${Nt} `);console.error(Mt[e](n))}function Pt(e){return F.default.italic(F.default.dim("`")+e+F.default.dim("`"))}var Ft=t(a(),1);async function It()
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
1import{AISDKError as e,APICallError as t,EmptyResponseBodyError as n,InvalidArgumentError as r,InvalidResponseDataError as i,JSONParseError as a,LoadAPIKeyError as o,NoSuchProvider...
L2: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ...
L3: `))}};const It={major:4,minor:4,patch:3},N=p(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=It;let r=[...e._zod.def.checks??[]];e._zod.traits...
L4: if (${n}.issues.length) {
...
L72: ${i}`,d++;return}if(es(e,t,r)){f=e.slice(e.charCodeAt(t+6)===32?t+7:t+6,n)||void 0;return}if(r===105&&e.charCodeAt(t+1)===100&&e.charCodeAt(t+2)===58){let r=e.slice(e.charCodeAt(t+...
L73: ${t}`,d+
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.