Filesystem-first framework for durable backend AI agents that run anywhere.
AI Security Review
scanned 1mo ago · by lpm-firewall-ai
Inspectable source matches the published Vercel eve agent framework: no install hooks, tiny runtime dependency set, and user-invoked CLI and tools. A binary vendor adapter plus incomplete coverage of huge compiled bundles leave dual-use capability unresolved, so this cannot be marked clean.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
npm install does not run package lifecycle hooks; risk starts when a user runs the eve CLI or imports framework tools.
Impact
A consumer who runs eve can spawn processes, use shell and file tools, and call Vercel or model APIs; the unread adapter file remains an inspection gap.
Mechanism
User-invoked agent CLI and tools, plus an unreadable vendor binary
AI rationale
Inspectable source matches the published Vercel eve agent framework: no install hooks, tiny runtime dependency set, and user-invoked CLI and tools. A binary vendor adapter plus incomplete coverage of huge compiled bundles leave dual-use capability unresolved, so this cannot be marked clean.
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/src/compiled/@vercel/blob/index.js:
Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let t of this.seen.entries()){let r=t[1];if(e===t[0]){a(t);continue}if(n.external){let r=n.ex...
${n}`.trim()),new y.VercelOidcTokenError(t?`Failed to refresh OIDC token with the Vercel CLI: ${t}`:`Failed to refresh OIDC token with the Vercel CLI`)}}async function E(e,t,n){let...
${e.message}`),t?new p.VercelOidcTokenError(t):e}return e?.audience&&(t=await(0,d.exchangeVercelOidcToken)({token:t,audience:e.audience,jti:e.jti,skipCache:e.skipCache})),t}0&&(t.e...
`)||e.includes(`\r`)||e.includes(`\0`))===!1}funct
1import{a as e,i as t,t as n}from"../../_chunks/workflow/rolldown-runtime-8V8biNmG.js";import{$ as r,$n as i,$t as a,A as o,An as s,Ar as c,At as l,B as u,Bn as d,Bt as f,C as p,Cn ...
L2: `).map(e=>{let n=e.match(/^\s*at\s+(?:(.+?)\s+\()?(.+?):(\d+):(\d+)\)?$/);if(!n)return e;let[,i,a,o,s]=n;if(!a.includes(t))return e;let c=parseInt(o,10),l=parseInt(s,10),u=Ka(r,{li...
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
1import{i as e,t}from"./rolldown-runtime-8V8biNmG.js";import{t as n}from"./signal-exit-o3IPQwwv.js";var r=t(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=...
L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON....
L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),b=t(((t,n)=>{let r=e(`path`),i=u(),a=e=>{e=...
...
L6: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ...
L7: `))}}})),re=t((e=>{Object.defineProperty
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/src/compiled/_chunks/workflow/token-util-BneBe0g5.jsView on unpkg · L1
1import{i as e,t}from"./rolldown-runtime-8V8biNmG.js";import{t as n}from"./signal-exit-o3IPQwwv.js";var r=t(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=...
L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON....
L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),b=t(((t,n)=>{let r=e(`path`),i=u(),a=e=>{e=...
L4: `);return _?(a.originalMessage=a.message,a.message=y):a=Error(y),a.shortMessage=v,a.command=c,a.escapedCommand=l,a.exitCode=s,a.signal=o,a.signalDescription=m,a.stdout=e,a.stderr=t...
L5: `)}})),q=t((e=>{var t=e&&e.__createBinding||
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
dist/src/compiled/_chunks/workflow/token-util-BneBe0g5.jsView on unpkg · L1
1import{i as e,t}from"./rolldown-runtime-8V8biNmG.js";import{t as n}from"./signal-exit-o3IPQwwv.js";var r=t(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=...
L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON....
L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),b=t(((t,n)=>{let r=e(`path`),i=u(),a=e=>{e=...
L4: `);return _?(a.originalMessage=a.message,a.message=y):a=Error(y),a.shortMessage=v,a.command=c,a.escapedCommand=l,a.exitCode=s,a.signal=o,a.signalDescription=m,a.stdout=e,a.stderr=t...
L5: `)}})),q=t((e=>{var t=e&&e.__createBinding||
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/src/compiled/_chunks/workflow/token-util-BneBe0g5.jsView on unpkg · L1
1import{AISDKError as e,APICallError as t,EmptyResponseBodyError as n,InvalidArgumentError as r,InvalidResponseDataError as i,JSONParseError as a,LoadAPIKeyError as o,NoSuchProvider...
L2: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ...
L3: `))}};const It={major:4,minor:4,patch:3},N=p(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=It;let r=[...e._zod.def.checks??[]];e._zod.traits...
L4: if (${n}.issues.length) {
...
L72: ${i}`,d++;return}if(es(e,t,r)){f=e.slice(e.charCodeAt(t+6)===32?t+7:t+6,n)||void 0;return}if(r===105&&e.charCodeAt(t+1)===100&&e.charCodeAt(t+2)===58){let r=e.slice(e.charCodeAt(t+...
L73: ${t}`,d+
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/src/compiled/@vercel/blob/index.js:
Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let t of this.seen.entries()){let r=t[1];if(e===t[0]){a(t);continue}if(n.external){let r=n.ex...
${n}`.trim()),new y.VercelOidcTokenError(t?`Failed to refresh OIDC token with the Vercel CLI: ${t}`:`Failed to refresh OIDC token with the Vercel CLI`)}}async function E(e,t,n){let...
${e.message}`),t?new p.VercelOidcTokenError(t):e}return e?.audience&&(t=await(0,d.exchangeVercelOidcToken)({token:t,audience:e.audience,jti:e.jti,skipCache:e.skipCache})),t}0&&(t.e...
`)||e.includes(`\r`)||e.includes(`\0`))===!1}funct
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/src/compiled/@vercel/blob/index.jsView on unpkg
1Trigger-reachable command-output exfiltration chain: manifest.exports -> [redacted].d.ts -> [redacted]-blob.js -> dist/src/compiled/@vercel/blob/index.js
L1: import{createRequire as e}from"node:module";import{Readable as t}from"stream";var n=Object.create,r=Object.defineProperty,i=Object.getOwnPropertyDescriptor,a=Object.getOwnPropertyN...
L2: `)}async function m(e){try{if(!(await(0,u.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON....
L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),P=c(((e,t)=>{let n=d(`path`),r=w(),i=e=>{e=...
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
1import{a as e,i as t,t as n}from"../../_chunks/workflow/rolldown-runtime-8V8biNmG.js";import{$ as r,$n as i,$t as a,A as o,An as s,Ar as c,At as l,B as u,Bn as d,Bt as f,C as p,Cn ...
L2: `).map(e=>{let n=e.match(/^\s*at\s+(?:(.+?)\s+\()?(.+?):(\d+):(\d+)\)?$/);if(!n)return e;let[,i,a,o,s]=n;if(!a.includes(t))return e;let c=parseInt(o,10),l=parseInt(s,10),u=Ka(r,{li...
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
1import{i as e,t}from"./rolldown-runtime-8V8biNmG.js";import{t as n}from"./signal-exit-o3IPQwwv.js";var r=t(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=...
L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON....
L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),b=t(((t,n)=>{let r=e(`path`),i=u(),a=e=>{e=...
...
L6: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ...
L7: `))}}})),re=t((e=>{Object.defineProperty
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/src/compiled/_chunks/workflow/token-util-BneBe0g5.jsView on unpkg · L1
1import{i as e,t}from"./rolldown-runtime-8V8biNmG.js";import{t as n}from"./signal-exit-o3IPQwwv.js";var r=t(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=...
L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON....
L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),b=t(((t,n)=>{let r=e(`path`),i=u(),a=e=>{e=...
L4: `);return _?(a.originalMessage=a.message,a.message=y):a=Error(y),a.shortMessage=v,a.command=c,a.escapedCommand=l,a.exitCode=s,a.signal=o,a.signalDescription=m,a.stdout=e,a.stderr=t...
L5: `)}})),q=t((e=>{var t=e&&e.__createBinding||
1import{AISDKError as e,APICallError as t,EmptyResponseBodyError as n,InvalidArgumentError as r,InvalidResponseDataError as i,JSONParseError as a,LoadAPIKeyError as o,NoSuchProvider...
L2: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ...
L3: `))}};const It={major:4,minor:4,patch:3},N=p(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=It;let r=[...e._zod.def.checks??[]];e._zod.traits...
L4: if (${n}.issues.length) {
...
L72: ${i}`,d++;return}if(es(e,t,r)){f=e.slice(e.charCodeAt(t+6)===32?t+7:t+6,n)||void 0;return}if(r===105&&e.charCodeAt(t+1)===100&&e.charCodeAt(t+2)===58){let r=e.slice(e.charCodeAt(t+...
L73: ${t}`,d+
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.