registry / eve / 0.47.3

eve@0.47.3

Filesystem-first framework for durable backend AI agents that run anywhere.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No concrete malicious lifecycle chain or exfiltration payload was established, but incomplete inspection of a large compiled artifact prevents a clean verdict. Downgrade to a warning for the remaining runtime and analysis risk.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Running the Eve CLI or a feature that refreshes Vercel OIDC credentials.

Impact

A local hostname may be disclosed to Vercel during OIDC discovery; incomplete analysis leaves residual runtime risk.

Mechanism

Command spawning and Vercel OIDC network requests.

AI rationale

Evidence

bin/eve.jsdist/src/compiled/_chunks/workflow/token-util-BneBe0g5.js

Network endpoints1

vercel.com

Decision evidence

public snapshot

AI called this Suspicious at 72.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The shipped CLI imports Node's process-spawning API.
Bundled Vercel OIDC code includes the local hostname in a User-Agent sent to vercel.com.
A 2.4 MB compiled chat-adapter artifact and other bundled code could not be fully source-analyzed, so the package cannot be safely cleared.

Evidence against

package.json has no preinstall, install, postinstall, or prepare hook.
The inspected hostname request is a Vercel OIDC discovery request, not a demonstrated secret-upload routine.
No self-dependency, install-time mutation, credential harvesting, or destructive action was confirmed.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Source & flagged code

26 flagged

dist/src/compiled/@vercel/blob/index.jsView file

28patternName = private_key_rsa severity = critical line = 28

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/compiled/@vercel/blob/index.jsView on unpkg · L28

28patternName = private_key_rsa severity = critical line = 28

Critical

Secret Pattern

RSA private key in dist/src/compiled/@vercel/blob/index.js

dist/src/compiled/@vercel/blob/index.jsView on unpkg · L28

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/src/compiled/@vercel/blob/index.js: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let t of this.seen.entries()){let r=t[1];if(e===t[0]){a(t);continue}if(n.external){let r=n.ex... ${n}`.trim()),new y.VercelOidcTokenError(t?`Failed to refresh OIDC token with the Vercel CLI: ${t}`:`Failed to refresh OIDC token with the Vercel CLI`)}}async function E(e,t,n){let... ${e.message}`),t?new p.VercelOidcTokenError(t):e}return e?.audience&&(t=await(0,d.exchangeVercelOidcToken)({token:t,audience:e.audience,jti:e.jti,skipCache:e.skipCache})),t}0&&(t.e... `)||e.includes(`\r`)||e.includes(`\0`))===!1}funct

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/src/compiled/@vercel/blob/index.jsView on unpkg

1Trigger-reachable command-output exfiltration chain: manifest.exports -> [redacted].d.ts -> [redacted]-blob.js -> dist/src/compiled/@vercel/blob/index.js L1: import{createRequire as e}from"node:module";import{Readable as t}from"stream";var n=Object.create,r=Object.defineProperty,i=Object.getOwnPropertyDescriptor,a=Object.getOwnPropertyN... L2: `)}async function m(e){try{if(!(await(0,u.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON.... L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),P=c(((e,t)=>{let n=d(`path`),r=w(),i=e=>{e=...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/src/compiled/@vercel/blob/index.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = eve@0.51.0 matchedPath = dist/src/compiled/@vercel/blob/index.js matchedIdentity = npm:ZXZl:0.51.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/compiled/@vercel/blob/index.jsView on unpkg

bin/eve.jsView file

2L3: import { spawn } from "node:child_process"; L4: import { access, readdir, realpath, stat } from "node:fs/promises";

High

Child Process

Package source references child process execution.

bin/eve.jsView on unpkg · L2

2Cross-file remote execution chain: bin/eve.js spawns dist/src/compiled/@agentclientprotocol/sdk/index.js; helper contains network access plus dynamic code execution. L2: L3: import { spawn } from "node:child_process"; L4: import { access, readdir, realpath, stat } from "node:fs/promises"; ... L9: const require = createRequire(import.meta.url); L10: const packageJson = require("../package.json"); L11: const packageNodeEngine = packageJson.engines?.node; ... L350: } L351: process.exitCode = 1; L352: } finally {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/eve.jsView on unpkg · L2

8L9: const require = createRequire(import.meta.url); L10: const packageJson = require("../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/eve.jsView on unpkg · L8

dist/src/compiled/gray-matter/index.jsView file

43return `+str.trim()+`; L44: }());`),eval(str)||{}}catch(e){if(wrap!==!1&&/(unexpected|identifier)/i.test(e.message))return parse(str,options,!1);throw SyntaxError(e)}},stringify:function(){throw Error(`string... L45: `?e:e+`

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/compiled/gray-matter/index.jsView on unpkg · L43

dist/src/compiled/@workflow/core/runtime.jsView file

1import{a as e,i as t,t as n}from"../../_chunks/workflow/rolldown-runtime-8V8biNmG.js";import{$ as r,$n as i,$t as a,A as o,An as s,Ar as c,At as l,B as u,Bn as d,Bt as f,C as p,Cn ... L2: `).map(e=>{let n=e.match(/^\s*at\s+(?:(.+?)\s+$)?(.+?):(\d+):(\d+)$?$/);if(!n)return e;let[,i,a,o,s]=n;if(!a.includes(t))return e;let c=parseInt(o,10),l=parseInt(s,10),u=Ka(r,{li...

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/src/compiled/@workflow/core/runtime.jsView on unpkg · L1

dist/src/internal/authored-module-loader.jsView file

3`).filter(e=>!e.startsWith(`//#region `)&&e!==`//#endregion`).join(` L4: `)}async function loadBundledAuthoredModule(t,n){let i=await bundleAuthoredModuleCode(t,n),a=normalizeExternalDependencies(n.externalDependencies),c=createHash(`sha1`).update(t).up...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/internal/authored-module-loader.jsView on unpkg · L3

dist/src/compiled/_chunks/workflow/token-util-BneBe0g5.jsView file

1import{i as e,t}from"./rolldown-runtime-8V8biNmG.js";import{t as n}from"./signal-exit-o3IPQwwv.js";var r=t(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=... L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON.... L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),b=t(((t,n)=>{let r=e(`path`),i=u(),a=e=>{e=... ... L6: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ... L7: `))}}})),re=t((e=>{Object.defineProperty

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/compiled/_chunks/workflow/token-util-BneBe0g5.jsView on unpkg · L1

1import{i as e,t}from"./rolldown-runtime-8V8biNmG.js";import{t as n}from"./signal-exit-o3IPQwwv.js";var r=t(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=... L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON.... L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),b=t(((t,n)=>{let r=e(`path`),i=u(),a=e=>{e=... L4: `);return _?(a.originalMessage=a.message,a.message=y):a=Error(y),a.shortMessage=v,a.command=c,a.escapedCommand=l,a.exitCode=s,a.signal=o,a.signalDescription=m,a.stdout=e,a.stderr=t... L5: `)}})),q=t((e=>{var t=e&&e.__createBinding||

High

dist/src/compiled/@vercel/sandbox/index.jsView file

1import{o as e}from"../../_chunks/node/rolldown-runtime-DaDcL9Zw.js";import{n as t,t as n}from"../../_chunks/node/dist-DsNhwdzf.js";import{n as r}from"../../_chunks/node/retry-qwFNG... L2: `):t;let n=t.replace(/^/gm,`${mt} `);console.error(pt[e](n))}function ht(e){return L.default.italic(L.default.dim("`")+e+L.default.dim("`"))}var gt=e(r(),1);async function _t(){ret... L3: `));if(e.teamId&&e.projectId)return{token:o.token,teamId:e.teamId,projectId:e.projectId};let s=await a({teamId:e.teamId,token:o.token});return s.created&&R(`info`,`Created default ... ... L7: `).filter(Boolean).map(t=>Ht(t,e))}let n=await this.sandbox.runCommand(`ls`,[`-1`,e],{signal:t?.signal});if(n.exitCode!==0){let t=await n.stderr();throw t.includes(`No such file or... L8: `).filter(Boolean)}async stat(e,t){"use

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/compiled/@vercel/sandbox/index.jsView on unpkg · L1

dist/src/compiled/_chunks/workflow/dist-eUxFublw.jsView file

1import{AISDKError as e,APICallError as t,EmptyResponseBodyError as n,InvalidArgumentError as r,InvalidResponseDataError as i,JSONParseError as a,LoadAPIKeyError as o,NoSuchProvider... L2: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ... L3: `))}};const It={major:4,minor:4,patch:3},N=p(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=It;let r=[...e._zod.def.checks??[]];e._zod.traits... L4: if (${n}.issues.length) { ... L72: ${i}`,d++;return}if(es(e,t,r)){f=e.slice(e.charCodeAt(t+6)===32?t+7:t+6,n)||void 0;return}if(r===105&&e.charCodeAt(t+1)===100&&e.charCodeAt(t+2)===58){let r=e.slice(e.charCodeAt(t+... L73: ${t}`,d+

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/src/compiled/_chunks/workflow/dist-eUxFublw.jsView on unpkg · L1

dist/src/compiled/shadcn-registry/index.jsView file

•path = dist/src/compiled/shadcn-registry/index.js kind = oversized_source_file sizeBytes = 9760341 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/src/compiled/shadcn-registry/index.jsView on unpkg

dist/src/compiled/@photon-ai/chat-adapter-imessage/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/compiled/@photon-ai/chat-adapter-imessage/index.jsView on unpkg

dist/src/compiled/@vercel/otel/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = eve@0.55.0 matchedIdentity = npm:ZXZl:0.55.0 similarity = 0.350 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/compiled/@vercel/otel/index.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = eve@0.51.0 matchedPath = dist/src/compiled/@vercel/otel/index.js matchedIdentity = npm:ZXZl:0.51.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/compiled/@vercel/otel/index.jsView on unpkg

dist/src/public/next/server.jsView file

•matchType = normalized_sha256 matchedPackage = eve@0.51.0 matchedPath = dist/src/public/next/server.js matchedIdentity = npm:ZXZl:0.51.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/public/next/server.jsView on unpkg

dist/src/public/nuxt/dev-server.jsView file

•matchType = normalized_sha256 matchedPackage = eve@0.51.0 matchedPath = dist/src/public/nuxt/dev-server.js matchedIdentity = npm:ZXZl:0.51.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/public/nuxt/dev-server.jsView on unpkg

dist/src/public/sveltekit/dev-server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/public/sveltekit/dev-server.jsView on unpkg

dist/src/setup/primitives/run-vercel.jsView file

•matchType = normalized_sha256 matchedPackage = eve@0.51.0 matchedPath = dist/src/setup/primitives/run-vercel.js matchedIdentity = npm:ZXZl:0.51.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/setup/primitives/run-vercel.jsView on unpkg

dist/src/public/channels/auth.jsView file

•matchType = normalized_sha256 matchedPackage = eve@0.51.0 matchedPath = dist/src/public/channels/auth.js matchedIdentity = npm:ZXZl:0.51.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/public/channels/auth.jsView on unpkg

dist/src/channel/auth/http-basic.jsView file

•matchType = normalized_sha256 matchedPackage = eve@0.51.0 matchedPath = dist/src/channel/auth/http-basic.js matchedIdentity = npm:ZXZl:0.51.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/channel/auth/http-basic.jsView on unpkg

Source & flagged code

26 flagged · loading source

dist/src/compiled/@vercel/blob/index.jsView file

28patternName = private_key_rsa severity = critical line = 28

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/compiled/@vercel/blob/index.jsView on unpkg · L28

28patternName = private_key_rsa severity = critical line = 28

Critical

Secret Pattern

RSA private key in dist/src/compiled/@vercel/blob/index.js

dist/src/compiled/@vercel/blob/index.jsView on unpkg · L28

Findings

3 Critical19 High6 Medium6 Low

CriticalCritical Secretdist/src/compiled/@vercel/blob/index.js

CriticalPrevious Version Dangerous Deltadist/src/compiled/@vercel/otel/index.js

CriticalSecret Patterndist/src/compiled/@vercel/blob/index.js

HighChild Processbin/eve.js

HighShell

HighSame File Env Network Executiondist/src/compiled/_chunks/workflow/token-util-BneBe0g5.js

HighHost Fingerprint Exfiltrationdist/src/compiled/_chunks/workflow/token-util-BneBe0g5.js

HighCredential Redirect Persistencedist/src/compiled/@vercel/blob/index.js

HighCommand Output Exfiltrationdist/src/compiled/_chunks/workflow/token-util-BneBe0g5.js

HighSandbox Evasion Gated Capabilitydist/src/compiled/@vercel/sandbox/index.js

Affected versions and remediation

This report applies to eve@0.47.3.

See all versions of eve for other recorded verdicts.

Review the evidence and your use of eve@0.47.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-16 14:21:06.141Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code