Loading npm security reports…
eve@0.52.0: Agent extension lifecycle risk – npm package flagged | LPM Firewall
Flagged as agent extension risk
Allowed by default with warning: install-time first-party agent extension setup was detected.
scanned 2mo ago · by lpm-firewall-ai No concrete malware or lifecycle abuse was found, but the guarded self-modification extension is a meaningful agent-extension capability that warrants a warning.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Run an Eve development agent session with EVE_DEV=1.
Impact
A prompted agent could modify authored project source within its configured sandbox.
Mechanism
Development-gated source-editing agent extension.
AI rationale
No concrete malware or lifecycle abuse was found, but the guarded self-modification extension is a meaningful agent-extension capability that warrants a warning.
Evidence
dist/src/self-modification/agent.js dist/src/self-modification/extension/tools/edit_file.js dist/src/cli/telemetry/flush.js
public snapshot AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
The package registers a built-in self-modification extension. A development-only agent can edit authored source when EVE_DEV is enabled. The CLI can send telemetry events to Vercel. Evidence against
package.json has no preinstall, install, or postinstall hook. The only self-package reference is an aliased devDependency, not a runtime dependency. No automatic install-time execution, credential harvesting, or foreign agent-control-surface mutation was found. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem NativeBindings Network Shell
Supply chain HighEntropyStrings Minified PossibleObfuscation Protestware UrlStrings
Manifest No manifest risk signals triggered.
25 flagged · loading source dist/src/compiled/@vercel/blob/index.js View file 28 patternName = private_key_rsa
severity = critical
line = 28
Critical Critical Secret
Package contains a critical-looking secret pattern.
dist/src/compiled/@vercel/blob/index.js View on unpkg · L28 28 patternName = private_key_rsa
severity = critical
line = 28
Critical Secret Pattern
RSA private key in dist/src/compiled/@vercel/blob/index.js
dist/src/compiled/@vercel/blob/index.js View on unpkg · L28 2 L3: import { spawn } from "node:child_process";
L4: import { access, readdir, realpath, stat } from "node:fs/promises";
High Child Process
Package source references child process execution.
bin/eve.js View on unpkg · L2 3 Critical 18 High 7 Medium 6 Low
Critical Critical Secret dist/src/compiled/@vercel/blob/index.js
Critical Previous Version Dangerous Delta dist/src/compiled/@vercel/otel/index.js
Critical Secret Pattern dist/src/compiled/@vercel/blob/index.js
High Child Process bin/eve.js
High Shell
High Same File Env Network Execution dist/src/compiled/@ai-sdk/code-mode/index.js
High Host Fingerprint Exfiltration dist/src/compiled/_chunks/workflow/token-util-BneBe0g5.js
High Command Output Exfiltration dist/src/compiled/_chunks/workflow/token-util-BneBe0g5.js
High Sandbox Evasion Gated Capability dist/src/compiled/@vercel/sandbox/index.js
High Cloud Metadata Access dist/src/compiled/_chunks/workflow/dist-Cz-ffHKC.js
Affected versions and remediation This report applies to eve@0.52.0 .
See all versions of eve for other recorded verdicts.
Review the evidence and your use of eve@0.52.0 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-09-05 02:02:39.995Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
82% Suspicious
AI assessment confidence
Package metadata npm Maintainers rauchg, vercel-release-bot, matt.straka
Version 0.52.0
Latest on npm 0.83.0
Published Sep 4, 2026
License Apache-2.0
Dependencies 7
Integrity verified
Package size 8.25 MB
Files 3,838
Keywords agent-framework agents ai-agents ai-sdk evals eve mcp model-context-protocol
scanned 1,564 file(s), 12.5 MB of source, external domains: 127.0.0.1, adaptivecards.io, ai-gateway.vercel.sh, ai.google.dev, ai.todoist.net, api-ssl.bitly.com, api.anthropic.com, api.botframework.com, api.brex.com, api.browser-use.com, api.github.com, api.linear.app, api.linqapp.com, api.notion.com, api.openai.com, api.oreilly.com, api.telegram.org, api.twilio.com, api.vercel.com, app.photon.codes, asset-management.mcp.cloudinary.com, chatgpt.com, coda.io, connect.vercel.com, developers.notion.com, discord.com, docs.cloud.google.com, docs.slack.dev, eve.dev, eve.invalid, eve.local, example.com, generativelanguage.googleapis.com, github.com, google.aip.dev, huggingface.co, json-schema.org, json.schemastore.org, login.botframework.com, login.microsoftonline.com, mcp-server.egnyte.com, mcp-server.zomato.com, mcp.agentcard.sh, mcp.airtable.com, mcp.candid.org, mcp.clickhouse.cloud, mcp.context.dev, mcp.datadoghq.com, mcp.honeycomb.io, mcp.linear.app
Oversized source lightweight scan
dist/src/compiled/@photon-ai/chat-adapter-imessage/index.js 2.17 MB file, sampled 256 KB
Filesystem Network ChildProcess EnvironmentVars Minified
dist/src/compiled/shadcn-registry/index.js 9.31 MB file, sampled 256 KB
Filesystem Network ChildProcess EnvironmentVars Minified UrlStrings ui.shadcn.com
2 Cross-file remote execution chain: bin/eve.js spawns dist/src/compiled/@agentclientprotocol/sdk/index.js; helper contains network access plus dynamic code execution.
L2:
L3: import { spawn } from "node:child_process";
L4: import { access, readdir, realpath, stat } from "node:fs/promises";
...
L9: const require = createRequire(import.meta.url);
L10: const packageJson = require("../package.json");
L11: const packageNodeEngine = packageJson.engines?.node;
...
L354: }
L355: process.exitCode = 1;
L356: } finally {
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/eve.js View on unpkg · L2 • matchType = normalized_sha256
matchedPackage = eve@0.51.0
matchedPath = bin/eve.js
matchedIdentity = npm:ZXZl:0.51.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/eve.js View on unpkg 8 L9: const require = createRequire(import.meta.url);
L10: const packageJson = require("../package.json");
Medium Dynamic Require
Package source references dynamic require/import behavior.
bin/eve.js View on unpkg · L8 dist/src/compiled/gray-matter/index.js View file 43 return `+str.trim()+`;
L44: }());`),eval(str)||{}}catch(e){if(wrap!==!1&&/(unexpected|identifier)/i.test(e.message))return parse(str,options,!1);throw SyntaxError(e)}},stringify:function(){throw Error(`string...
L45: `?e:e+`
Low Eval
Package source references a known benign dynamic code generation pattern.
dist/src/compiled/gray-matter/index.js View on unpkg · L43 dist/src/compiled/@workflow/core/runtime.js View file 1 import{a as e,i as t,t as n}from"../../_chunks/workflow/rolldown-runtime-8V8biNmG.js";import{t as r}from"../../_chunks/workflow/global-singleton-BNinwFrL.js";import{$ as i,$t as a,...
L2: `).map(e=>{let n=e.match(/^\s*at\s+(?:(.+?)\s+\()?(.+?):(\d+):(\d+)\)?$/);if(!n)return e;let[,i,a,o,s]=n;if(!a.includes(t))return e;let c=parseInt(o,10),l=parseInt(s,10),u=to(r,{li...
Medium Unsafe Vm Context
Package source executes code through a VM context API.
dist/src/compiled/@workflow/core/runtime.js View on unpkg · L1 dist/src/internal/authored-module-loader.js View file 3 `).filter(e=>!e.startsWith(`//#region `)&&e!==`//#endregion`).join(`
L4: `)}async function loadBundledAuthoredModule(t,n){let i=await bundleAuthoredModuleCode(t,n),a=normalizeExternalDependencies(n.externalDependencies),o=createHash(`sha1`).update(t).up...
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/src/internal/authored-module-loader.js View on unpkg · L3 dist/src/compiled/@ai-sdk/code-mode/index.js View file 649 \`)}catch(i){throw B(k(t,i))}let s=t.newObject(),o=[["log",de(t,"console.log","stdout",r,n)],["info",de(t,"console.info","stdout",r,n)],["debug",de(t,"console.debug","stdout",r,n)]...
L650: \`,l=Buffer.byteLength(u);return l>n.remainingBytes?(n.remainingBytes=0,t.undefined):(n.remainingBytes-=l,it(r==="stderr"?2:1,u),t.undefined)})}function er(t,e,r,n){let s=t.newNumb...
L651: ${e}
...
L658: }`:s}function Ei(e,t){let n=e.items;if(Array.isArray(n))return`[${n.map(e=>$(e)?Z(e,Q(t)):`unknown`).join(`, `)}]`;if($(n)){let e=Z(n,Q(t));return Pi(e)||e.includes(`
L659: `)?`Array<${e}>`:`${e}[]`}return`unknown[]`}function Di(e,t){return Oi(e,{root:t,seenRefs:new Set,depth:0})}function Oi(e,t){if(t.depth>8)return null;if(e.default!==void 0)return e...
L660: `))return e;let n=` `.repeat(t);retu
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/src/compiled/@ai-sdk/code-mode/index.js View on unpkg · L649 dist/src/compiled/_chunks/workflow/token-util-BneBe0g5.js View file 1 import{i as e,t}from"./rolldown-runtime-8V8biNmG.js";import{t as n}from"./signal-exit-o3IPQwwv.js";var r=t(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=...
L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON....
L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),b=t(((t,n)=>{let r=e(`path`),i=u(),a=e=>{e=...
L4: `);return _?(a.originalMessage=a.message,a.message=y):a=Error(y),a.shortMessage=v,a.command=c,a.escapedCommand=l,a.exitCode=s,a.signal=o,a.signalDescription=m,a.stdout=e,a.stderr=t...
L5: `)}})),q=t((e=>{var t=e&&e.__createBinding||
High Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
dist/src/compiled/_chunks/workflow/token-util-BneBe0g5.js View on unpkg · L1 1 import{i as e,t}from"./rolldown-runtime-8V8biNmG.js";import{t as n}from"./signal-exit-o3IPQwwv.js";var r=t(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=...
L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON....
L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),b=t(((t,n)=>{let r=e(`path`),i=u(),a=e=>{e=...
L4: `);return _?(a.originalMessage=a.message,a.message=y):a=Error(y),a.shortMessage=v,a.command=c,a.escapedCommand=l,a.exitCode=s,a.signal=o,a.signalDescription=m,a.stdout=e,a.stderr=t...
L5: `)}})),q=t((e=>{var t=e&&e.__createBinding||
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/src/compiled/_chunks/workflow/token-util-BneBe0g5.js View on unpkg · L1 dist/src/compiled/@vercel/sandbox/index.js View file 1 import{o as e}from"../../_chunks/node/rolldown-runtime-DaDcL9Zw.js";import{n as t,t as n}from"../../_chunks/node/dist-DsNhwdzf.js";import{n as r}from"../../_chunks/node/retry-qwFNG...
L2: `):t;let n=t.replace(/^/gm,`${gt} `);console.error(ht[e](n))}function _t(e){return I.default.italic(I.default.dim("`")+e+I.default.dim("`"))}var vt=e(r(),1);async function yt(){ret...
L3: `));if(e.teamId&&e.projectId)return{token:o.token,teamId:e.teamId,projectId:e.projectId};let s=await a({teamId:e.teamId,token:o.token});return s.created&&L(`info`,`Created default ...
...
L7: `).filter(Boolean).map(t=>Wt(t,e))}let n=await this.sandbox.runCommand(`ls`,[`-1`,e],{signal:t?.signal});if(n.exitCode!==0){let t=await n.stderr();throw t.includes(`No such file or...
L8: `).filter(Boolean)}async stat(e,t){"use
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/src/compiled/@vercel/sandbox/index.js View on unpkg · L1 dist/src/compiled/_chunks/workflow/dist-Cz-ffHKC.js View file 1 var e=`vercel.ai.error`,t=Symbol.for(e),n,r,i=class i extends (r=Error,n=t,r){constructor({name:e,message:t,cause:r}){super(t),this[n]=!0,this.name=e,this.cause=r}static isInstance...
L2: Error message: ${g(t)}`,cause:t}),this[Se]=!0,this.text=e}static isInstance(e){return i.hasMarker(e,be)}},Te=`AI_LoadAPIKeyError`,Ee=`vercel.ai.error.${Te}`,De=Symbol.for(Ee),Oe,ke...
L3: Error message: ${g(t)}`,cause:t}),this[Qe]=!0,this.value=e,this.context=n}static isInstance(e){return i.hasMarker(e,Xe)}static wrap({value:t,cause:n,context:r}){return e.isInstance...
L4: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ...
L5: `)}\n};`)(...Object.values(this.closed))}};c
High Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/src/compiled/_chunks/workflow/dist-Cz-ffHKC.js View on unpkg · L1 dist/src/compiled/shadcn-registry/index.js View file • path = dist/src/compiled/shadcn-registry/index.js
kind = oversized_source_file
sizeBytes = 9760341
magicHex = [redacted]
Medium Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/src/compiled/shadcn-registry/index.js View on unpkg dist/src/compiled/@photon-ai/chat-adapter-imessage/index.js View file • stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 9
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/src/compiled/@photon-ai/chat-adapter-imessage/index.js View on unpkg dist/src/compiled/@vercel/otel/index.js View file • matchType = previous_version_dangerous_delta
matchedPackage = eve@0.52.1
matchedIdentity = npm:ZXZl:0.52.1
similarity = 0.667
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/src/compiled/@vercel/otel/index.js View on unpkg • matchType = normalized_sha256
matchedPackage = eve@0.51.0
matchedPath = dist/src/compiled/@vercel/otel/index.js
matchedIdentity = npm:ZXZl:0.51.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/compiled/@vercel/otel/index.js View on unpkg dist/src/compiled/@vercel/oidc/index.js View file • matchType = normalized_sha256
matchedPackage = eve@0.51.0
matchedPath = dist/src/compiled/@vercel/oidc/index.js
matchedIdentity = npm:ZXZl:0.51.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/compiled/@vercel/oidc/index.js View on unpkg • matchType = normalized_sha256
matchedPackage = eve@0.51.0
matchedPath = dist/src/public/next/server.js
matchedIdentity = npm:ZXZl:0.51.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/public/next/server.js View on unpkg • matchType = normalized_sha256
matchedPackage = eve@0.51.0
matchedPath = dist/src/public/nuxt/dev-server.js
matchedIdentity = npm:ZXZl:0.51.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/public/nuxt/dev-server.js View on unpkg dist/src/public/sveltekit/dev-server.js View file • matchType = normalized_sha256
matchedPackage = eve@0.51.0
matchedPath = dist/src/public/nuxt/dev-server.js
matchedIdentity = npm:ZXZl:0.51.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/public/sveltekit/dev-server.js View on unpkg dist/src/setup/primitives/run-vercel.js View file • matchType = normalized_sha256
matchedPackage = eve@0.51.0
matchedPath = dist/src/setup/primitives/run-vercel.js
matchedIdentity = npm:ZXZl:0.51.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/setup/primitives/run-vercel.js View on unpkg • matchType = normalized_sha256
matchedPackage = eve@0.51.0
matchedPath = dist/src/public/channels/auth.js
matchedIdentity = npm:ZXZl:0.51.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/public/channels/auth.js View on unpkg • matchType = normalized_sha256
matchedPackage = eve@0.51.0
matchedPath = dist/src/channel/auth/http-basic.js
matchedIdentity = npm:ZXZl:0.51.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/channel/auth/http-basic.js View on unpkg High Cross File Remote Execution Context bin/eve.js
High Semantic Analysis Limited dist/src/compiled/@photon-ai/chat-adapter-imessage/index.js
High Known Malware Source Similarity dist/src/compiled/@vercel/otel/index.js
High Known Malware Source Similarity dist/src/compiled/@vercel/oidc/index.js
High Known Malware Source Similarity dist/src/public/next/server.js
High Known Malware Source Similarity dist/src/public/nuxt/dev-server.js
High Known Malware Source Similarity dist/src/public/sveltekit/dev-server.js
High Known Malware Source Similarity dist/src/setup/primitives/run-vercel.js
High Known Malware Source Similarity bin/eve.js
High Known Malware Source Similarity dist/src/public/channels/auth.js
High Known Malware Source Similarity dist/src/channel/auth/http-basic.js
Medium Dynamic Require bin/eve.js
Medium Unsafe Vm Context dist/src/compiled/@workflow/core/runtime.js
Medium Oversized Source File dist/src/compiled/shadcn-registry/index.js
Medium Structural Risk Force Deep Review
Low Eval dist/src/compiled/gray-matter/index.js
Low Weak Crypto dist/src/internal/authored-module-loader.js
Runtime surface package.json Entrypoints main → ./dist/src/index.js types → ./dist/src/index.d.ts exports map bin → eve
Runtime node >=24
Artifact 31.1 MB · 3,838 files 1 signature(s) · provenance
Install lifecycle No install hooks · other: build, build:compiled, build:js, build:types +8
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem NativeBindings Network Shell HighEntropyStrings Minified PossibleObfuscation Protestware UrlStrings Manifest: clean
25 flagged dist/src/compiled/@vercel/blob/index.js View file 28 patternName = private_key_rsa
severity = critical
line = 28
Critical Critical Secret
Package contains a critical-looking secret pattern.
dist/src/compiled/@vercel/blob/index.js View on unpkg · L28 28 patternName = private_key_rsa
severity = critical
line = 28
Critical Secret Pattern
RSA private key in dist/src/compiled/@vercel/blob/index.js
dist/src/compiled/@vercel/blob/index.js View on unpkg · L28 Lines 1-28 javascript
3 import { spawn } from "node:child_process" ;
4 import { access, readdir, realpath, stat } from "node:fs/promises" ;
High Child Process
Package source references child process execution.
bin/eve.js View on unpkg · L2 5 import { createRequire } from "node:module" ;
6 import { dirname, resolve } from "node:path" ;
7 import { fileURLToPath, pathToFileURL } from "node:url" ;
9 const require = createRequire ( import . meta .url);
10 const packageJson = require ( "../package.json" );
Medium Dynamic Require
Package source references dynamic require/import behavior.
bin/eve.js View on unpkg · L8 11 const packageNodeEngine = packageJson.engines?.node;
12 const bootstrapPackageRoot = resolve ( dirname ( fileURLToPath ( import . meta .url)), ".." );
15 if ( typeof packageNodeEngine !== "string" ) {
16 throw new Error ( "eve package.json must declare a valid engines.node range." );
19 function createBootstrapOptions ( overrides = {}) {
20 const packageRoot = overrides.packageRoot ?? bootstrapPackageRoot;
24 overrides.cliEntrypointPath ?? resolve (packageRoot, "dist" , "src" , "cli" , "run.js" ),
26 postBuildScriptPaths: overrides.postBuildScriptPaths ?? [
27 resolve (packageRoot, "scripts" , "copy-compiled-assets.mjs" ),
28 resolve (packageRoot, "scripts" , "copy-runtime-assets.mjs" ),
2 Cross-file remote execution chain: bin/eve.js spawns dist/src/compiled/@agentclientprotocol/sdk/index.js; helper contains network access plus dynamic code execution.
L2:
L3: import { spawn } from "node:child_process";
L4: import { access, readdir, realpath, stat } from "node:fs/promises";
...
L9: const require = createRequire(import.meta.url);
L10: const packageJson = require("../package.json");
L11: const packageNodeEngine = packageJson.engines?.node;
...
L354: }
L355: process.exitCode = 1;
L356: } finally {
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/eve.js View on unpkg · L2 • matchType = normalized_sha256
matchedPackage = eve@0.51.0
matchedPath = bin/eve.js
matchedIdentity = npm:ZXZl:0.51.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/eve.js View on unpkg dist/src/compiled/gray-matter/index.js View file Lines 23-48 javascript
23 `,o?1+l:l)):u?(u=!1,e.result+=n.repeat(`
24 `,l+1)):l===0?o&&(e.result+=` `):e.result+=n.repeat(`
25 `,l):e.result+=n.repeat(`
26 `,o?1+l:l),o=!0,s=!0,l=0,r=e.position;!x(h)&&h!==0;)h=e.input.charCodeAt(++e.position);I(e,r,e.position,!1)}return!0}function J(e,t){var n,r=e.tag,i=e.anchor,a=[],o,s=!1,c;for(e.anchor!==null&&(e.anchorMap[e.anchor]=a),c=e.input.charCodeAt(e.position);c!==0&&!(c!==45||(o=e.input.charCodeAt(e.position+1),!C(o)));){if(s=!0,e.position++,B(e,!0,-1)&&e.lineIndent<=t){a.push(null),c=e.input.charCodeAt(e.position);continue}if(n=e.line,Z(e,t,u,!1,!0),a.push(e.result),B(e,!0,-1),c=e.input.charCodeAt(e.position),(e.line===n||e.lineIndent>t)&&c!==0)N(e,` bad indentation of a sequence entry `);else if(e.lin ...
dist/src/compiled/@workflow/core/runtime.js View file Lines 1-3 javascript
1 import {a as e,i as t,t as n} from "../../_chunks/workflow/rolldown-runtime-8V8biNmG.js" ; import {t as r} from "../../_chunks/workflow/global-singleton-BNinwFrL.js" ; import {$ as i,$t as a,An as o,At as s,Bn as c,Bt as
dist/src/internal/authored-module-loader.js View file Lines 1-4 javascript
1 import {createHash} from "node:crypto" ; import {expectObjectRecord} from "#internal/authored-module.js" ; import {dirname,join,relative,resolve,sep} from "node:path" ; import {resolvePackageSourceFilePath} from "#internal/application/package.js" ; import {existsSync,mkdirSync,realpathSync,writeFileSync} from "node:fs" ; import
dist/src/compiled/@ai-sdk/code-mode/index.js View file 649 \`)}catch(i){throw B(k(t,i))}let s=t.newObject(),o=[["log",de(t,"console.log","stdout",r,n)],["info",de(t,"console.info","stdout",r,n)],["debug",de(t,"console.debug","stdout",r,n)]...
L650: \`,l=Buffer.byteLength(u);return l>n.remainingBytes?(n.remainingBytes=0,t.undefined):(n.remainingBytes-=l,it(r==="stderr"?2:1,u),t.undefined)})}function er(t,e,r,n){let s=t.newNumb...
L651: ${e}
...
L658: }`:s}function Ei(e,t){let n=e.items;if(Array.isArray(n))return`[${n.map(e=>$(e)?Z(e,Q(t)):`unknown`).join(`, `)}]`;if($(n)){let e=Z(n,Q(t));return Pi(e)||e.includes(`
L659: `)?`Array<${e}>`:`${e}[]`}return`unknown[]`}function Di(e,t){return Oi(e,{root:t,seenRefs:new Set,depth:0})}function Oi(e,t){if(t.depth>8)return null;if(e.default!==void 0)return e...
L660: `))return e;let n=` `.repeat(t);retu
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/src/compiled/@ai-sdk/code-mode/index.js View on unpkg · L649 dist/src/compiled/_chunks/workflow/token-util-BneBe0g5.js View file Lines 1-21 javascript
1 import {i as e,t} from "./rolldown-runtime-8V8biNmG.js" ; import {t as n} from "./signal-exit-o3IPQwwv.js" ; var r = t ((( e , t ) => { var n =
dist/src/compiled/@vercel/sandbox/index.js View file 1 import{o as e}from"../../_chunks/node/rolldown-runtime-DaDcL9Zw.js";import{n as t,t as n}from"../../_chunks/node/dist-DsNhwdzf.js";import{n as r}from"../../_chunks/node/retry-qwFNG...
L2: `):t;let n=t.replace(/^/gm,`${gt} `);console.error(ht[e](n))}function _t(e){return I.default.italic(I.default.dim("`")+e+I.default.dim("`"))}var vt=e(r(),1);async function yt(){ret...
L3: `));if(e.teamId&&e.projectId)return{token:o.token,teamId:e.teamId,projectId:e.projectId};let s=await a({teamId:e.teamId,token:o.token});return s.created&&L(`info`,`Created default ...
...
L7: `).filter(Boolean).map(t=>Wt(t,e))}let n=await this.sandbox.runCommand(`ls`,[`-1`,e],{signal:t?.signal});if(n.exitCode!==0){let t=await n.stderr();throw t.includes(`No such file or...
L8: `).filter(Boolean)}async stat(e,t){"use
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/src/compiled/@vercel/sandbox/index.js View on unpkg · L1 dist/src/compiled/_chunks/workflow/dist-Cz-ffHKC.js View file 1 var e=`vercel.ai.error`,t=Symbol.for(e),n,r,i=class i extends (r=Error,n=t,r){constructor({name:e,message:t,cause:r}){super(t),this[n]=!0,this.name=e,this.cause=r}static isInstance...
L2: Error message: ${g(t)}`,cause:t}),this[Se]=!0,this.text=e}static isInstance(e){return i.hasMarker(e,be)}},Te=`AI_LoadAPIKeyError`,Ee=`vercel.ai.error.${Te}`,De=Symbol.for(Ee),Oe,ke...
L3: Error message: ${g(t)}`,cause:t}),this[Qe]=!0,this.value=e,this.context=n}static isInstance(e){return i.hasMarker(e,Xe)}static wrap({value:t,cause:n,context:r}){return e.isInstance...
L4: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ...
L5: `)}\n};`)(...Object.values(this.closed))}};c
High Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/src/compiled/_chunks/workflow/dist-Cz-ffHKC.js View on unpkg · L1 dist/src/compiled/shadcn-registry/index.js View file • path = dist/src/compiled/shadcn-registry/index.js
kind = oversized_source_file
sizeBytes = 9760341
magicHex = [redacted]
Medium Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/src/compiled/shadcn-registry/index.js View on unpkg dist/src/compiled/@photon-ai/chat-adapter-imessage/index.js View file • stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 9
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/src/compiled/@photon-ai/chat-adapter-imessage/index.js View on unpkg dist/src/compiled/@vercel/otel/index.js View file • matchType = previous_version_dangerous_delta
matchedPackage = eve@0.52.1
matchedIdentity = npm:ZXZl:0.52.1
similarity = 0.667
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/src/compiled/@vercel/otel/index.js View on unpkg • matchType = normalized_sha256
matchedPackage = eve@0.51.0
matchedPath = dist/src/compiled/@vercel/otel/index.js
matchedIdentity = npm:ZXZl:0.51.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/compiled/@vercel/otel/index.js View on unpkg dist/src/compiled/@vercel/oidc/index.js View file • matchType = normalized_sha256
matchedPackage = eve@0.51.0
matchedPath = dist/src/compiled/@vercel/oidc/index.js
matchedIdentity = npm:ZXZl:0.51.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/compiled/@vercel/oidc/index.js View on unpkg • matchType = normalized_sha256
matchedPackage = eve@0.51.0
matchedPath = dist/src/public/next/server.js
matchedIdentity = npm:ZXZl:0.51.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/public/next/server.js View on unpkg • matchType = normalized_sha256
matchedPackage = eve@0.51.0
matchedPath = dist/src/public/nuxt/dev-server.js
matchedIdentity = npm:ZXZl:0.51.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/public/nuxt/dev-server.js View on unpkg dist/src/public/sveltekit/dev-server.js View file • matchType = normalized_sha256
matchedPackage = eve@0.51.0
matchedPath = dist/src/public/nuxt/dev-server.js
matchedIdentity = npm:ZXZl:0.51.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/public/sveltekit/dev-server.js View on unpkg dist/src/setup/primitives/run-vercel.js View file • matchType = normalized_sha256
matchedPackage = eve@0.51.0
matchedPath = dist/src/setup/primitives/run-vercel.js
matchedIdentity = npm:ZXZl:0.51.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/setup/primitives/run-vercel.js View on unpkg • matchType = normalized_sha256
matchedPackage = eve@0.51.0
matchedPath = dist/src/public/channels/auth.js
matchedIdentity = npm:ZXZl:0.51.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/public/channels/auth.js View on unpkg • matchType = normalized_sha256
matchedPackage = eve@0.51.0
matchedPath = dist/src/channel/auth/http-basic.js
matchedIdentity = npm:ZXZl:0.51.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/channel/auth/http-basic.js View on unpkg 0
)
===
65279
&&
(e
=
e.
slice
(
1
)));
var
n
=new
ne
(e,t),r
=
e.
indexOf
(
`
\0
`
);
for
(r
!==-
1
&&
(n.position
=
r,
N
(n,
`null byte is not allowed in input`
)),n.input
+=
`
\0
`
;n.input.
charCodeAt
(n.position)
===
32
;)n.lineIndent
+=
1
,n.position
+=
1
;
for
(;n.position
<
n.
length
-
1
;)
ae
(n);
return
n.documents}
function
oe
(
e
,
t
,
n
){
typeof
t
==
`object`
&&
t
&&
n
===void
0
&&
(n
=
t,t
=
null
);
var
r
=
Q
(e,n);
if
(
typeof
t
!=
`function`
)
return
r;
for
(
var
i
=
0
,a
=
r.
length
;i
<
a;i
+=
1
)
t
(r[i])}
function
se
(
e
,
t
){
var
n
=
Q
(e,t);
if
(n.
length
!==
0
){
if
(n.
length
===
1
)
return
n[
0
];
throw
new
r
(
`expected a single document in the stream, but found more`
)}}
function
ce
(
e
,
t
,
r
...
28 `,i),a===-1?(s=e.slice(i),i=c):(s=e.slice(i,a+1),i=a+1),s.length&&s!==`
29 `&&(o+=r),o+=s;return o}function F(e,t){return`
30 `+n.repeat(` `,e.indent*t)}function I(e,t){var n,r,i;for(n=0,r=e.implicitTypes.length;n<r;n+=1)if(i=e.implicitTypes[n],i.resolve(t))return!0;return!1}function L(e){return e===d||e===c}function R(e){return 32<=e&&e<=126||161<=e&&e<=55295&&e!==8232&&e!==8233||57344<=e&&e<=65533&&e!==65279||65536<=e&&e<=1114111}function z(e){return R(e)&&!L(e)&&e!==65279&&e!==u&&e!==l}function B(e,t){return R(e)&&e!==65279&&e!==y&&e!==T&&e!==E&&e!==O&&e!==k&&e!==x&&(e!==m||t&&z(t))}function V(e){return R(e)&&e!==65279&&!L(e)&&e!==b&&e!==w&&e!==x&&e!==y&&e!==T&&e!==E&&e!==O&&e!==k&&e!==m&&e!==g&&e!==v&&e!==f&&e!== ...
31 ` ; return n +( r &&( e [ e . length - 2 ]=== `
34 `} function X ( e ){ return e[e. length - 1 ] === `
35 ` ? e. slice ( 0 , - 1 ) : e} function ie ( e , t ){ for ( var n = /( \n + )( [ ^ \n] * )/ g , r =function (){ var r = e. indexOf ( `
36 ` ); return r = r ===- 1 ? e. length : r,n.lastIndex = r, Z (e. slice ( 0 ,r),t)}(),i = e[ 0 ] === `
37 ` || e[ 0 ] === ` ` ,a,o;o = n. exec (e);){ var s = o[ 1 ],c = o[ 2 ];a = c[ 0 ] === ` ` ,r += s + ( ! i &&! a && c !== `` ? `
38 ` : `` ) + Z (c,t),i = a} return r} function Z ( e , t ){ if (e === `` || e[ 0 ] === ` ` ) return e; for ( var n = / [ ^ ] / g ,r,i = 0 ,a,o = 0 ,s = 0 ,c = `` ;r = n. exec (e);)s = r.index,s - i > t && (a = o > i ? o : s,c += `
39 ` + e. slice (i,a),i = a + 1 ),o = s; return c += `
40 ` ,e. length - i > t && o > i ? c += e. slice (i,o) + `
41 ` + e. slice (o + 1 ) : c += e. slice (i),c. slice ( 1 )} function ae ( e ){ for ( var t = `` ,n,r,i,a = 0 ;a < e. length ;a ++ ){ if (n = e. charCodeAt (a),n >= 55296 && n <= 56319 && (r = e. charCodeAt (a + 1 ),r >= 56320 && r <= 57343 )){t += M ((n - 55296 ) * 1024 + r - 56320 + 65536 ),a ++ ; continue }i = A [n],t +=! i && R (n) ? e[a] : i || M (n)} return t} function Q ( e , t , n ){ var r = `` ,i = e.tag,a,o; for (a = 0 ,o = n. length ;a < o;a += 1 ) $ (e,t,n[a], ! 1 , ! 1 ) && (a !== 0 && (r += `,` + (e.condenseFlow ? `` : ` ` )),r += e.dump);e.tag = i,e.dump = `[` + r + `]` } function oe ( e , t , n , r ){ var i = `` ,a = e.tag,o,s; for (o = 0 ,s = n. length ;o < s;o += 1 ) $ (e,t + 1 ,n[o], ! 0 , ! 0 ) && (( ! r || o !== 0 ) && (i += F (e,t)),e.dump && l === e.dump. charCodeAt ( 0 ) ? i += `-` : i += `- ` ,i += e.d ...
42 `:``}function pe(e,t){return fe(e,n.extend({schema:a},t))}t.exports.dump=fe,t.exports.safeDump=pe})),require_js_yaml$1=__commonJSMin(((e,t)=>{var n=require_loader(),r=require_dumper();function i(e){return function(){throw Error(` Function `+e+` is deprecated and cannot be used. `)}}t.exports.Type=require_type(),t.exports.Schema=require_schema(),t.exports.FAILSAFE_SCHEMA=require_failsafe(),t.exports.JSON_SCHEMA=require_json(),t.exports.CORE_SCHEMA=require_core(),t.exports.DEFAULT_SAFE_SCHEMA=require_default_safe(),t.exports.DEFAULT_FULL_SCHEMA=require_default_full(),t.exports.load=n.load,t.export ...
44 }());` ), eval (str) || {}} catch (e){ if (wrap !==! 1 && /(unexpected | identifier)/ i . test (e.message)) return parse (str,options, ! 1 ); throw SyntaxError (e)}}, stringify : function (){ throw Error ( `stringifying JavaScript is not supported` )}}})),require_strip_bom_string = __commonJSMin ((( e , t ) => {t. exports =function ( e ){ return typeof e == `string` && e. charAt ( 0 ) === `` ? e. slice ( 1 ) : e}})),require_utils = __commonJSMin (( e => { let t = require_strip_bom_string (),n = require_kind_of ();e. define =function ( e , t , n ){Reflect. defineProperty (e,t,{enumerable: ! 1 ,configurable: ! 0 ,writable: ! 0 ,value:n})},e. isBuffer =function ( e ){ return n (e) === `buffer` },e.isObj ...
45 `?e:e+`
Low Eval
Package source references a known benign dynamic code generation pattern.
dist/src/compiled/gray-matter/index.js View on unpkg · L43 46 `}})),require_excerpt=__commonJSMin(((e,t)=>{let n=require_defaults();t.exports=function(e,t){let r=n(t);if(e.data??={},typeof r.excerpt==` function `) return r . excerpt ( e , r ); let i = e.data.excerpt_separator || r.excerpt_separator; if (i == null && (r.excerpt ===! 1 || r.excerpt == null )) return e; let a =typeof r.excerpt == `string` ? r.excerpt : i || r.delimiters[ 0 ],o = e.content. indexOf (a); return o !==- 1 && (e.excerpt = e.content. slice ( 0 ,o)),e}})),require_to_file = __commonJSMin ((( e , t ) => { let n = require_kind_of (),r = require_stringify (),i = require_utils ();t. exports =function ( e ){ return n (e) !== `object` && (e = {content:e}), n (e.data) !== `objec ...
47 ` + n.delimiters[ 1 ],c = e.content;n.language && (e.language = n.language); let f = a. length ; if ( ! u. startsWith (c,a,f)) return o (e,n),e; if (c. charAt (f) === a. slice ( - 1 )) return e;c = c. slice (f); let p = c. length ,m = d. language (c,n);m.name && (e.language = m.name,c = c. slice (m.raw. length )); let h = c. indexOf (s); return h ===- 1 && (h = p),e.matter = c. slice ( 0 ,h),e.matter. replace ( / ^ \s * # [ ^ \n] + / gm , `` ). trim () === `` ? (e.isEmpty =! 0 ,e.empty = e.content,e.data = {}) : e.data = l (e.language,e.matter,n),h === p ? e.content = `` : (e.content = c. slice (h + s. length ),e.content[ 0 ] === ` \r ` && (e.content = e.content. slice ( 1 )),e.content[ 0 ] === `
48 ` && (e.content = e.content. slice ( 1 ))), o (e,n),(n.sections ===! 0 ||typeof n.section == `function` ) && r (e,n.section),e}d.engines = s,d. stringify =function ( e , t , n ){ return typeof e == `string` && (e = d (e,n)), a (e,t,n)},d. read =function ( e , t ){ let r = d (n. readFileSync (e, `utf8` ),t); return r.path = e,r},d. test =function ( e , t ){ return u. startsWith (e, i (t).delimiters[ 0 ])},d. language =function ( e , t ){ let n = i (t).delimiters[ 0 ];d. test (e) && (e = e. slice (n. length )); let r = e. slice ( 0 ,e. search ( / \r ? \n / )); return {raw:r,name:r ? r. trim () : `` }},d.cache = {},d. clearCache =function (){d.cache = {}},t.exports = d})); export default require_gray_matter (); export {};
Long lines were clipped for display.
l,Cn
as
u,Cr
as
d,D
as
f,Dn
as
p,Dr
as
m,Dt
as
h,E
as
g,En
as
_,Er
as
v,Fn
as
y,Ft
as
b,G
as
x,Gn
as
S,Gt
as
C,H
as
ee,Hn
as
w,Ht
as
T,I
as
E,In
as
D,It
as
O,J
as
te,Jn
as
k,Jt
as
A,K
as
j,Kn
as
M,Kt
as
ne,L
as
N,Ln
as
P,Lt
as
F,Mn
as
I,Mr
as
L,Mt
as
re,Nn
as
ie,Nr
as
ae,Nt
as
oe,O
as
R,On
as
se,Ot
as
ce,Pn
as
z,Pr
as
le,Pt
as
ue,Q
as
B,Qt
as
V,R
as
H,Rn
as
U,Rt
as
de,Sn
as
fe,Sr
as
pe,S ...
2 `).map(e=>{let n=e.match(/^\s*at\s+(?:(.+?)\s+\()?(.+?):(\d+):(\d+)\)?$/);if(!n)return e;let[,i,a,o,s]=n;if(!a.includes(t))return e;let c=parseInt(o,10),l=parseInt(s,10),u=to(r,{line:c,column:l});if(u.source&&u.line!==null){let e=i||u.name||` anonymous `,t=u.column===null?l:u.column;return` at ${e} (${u.source}:${u.line}:${t}) `}return e}).join(`
Medium Unsafe Vm Context
Package source executes code through a VM context API.
dist/src/compiled/@workflow/core/runtime.js View on unpkg · L1 3 `)}catch{return e}}function lo(e,t,n){let r=(2<<31-Math.clz32(e.length-1|1))-1,i=Math.ceil(1.6*r*t/e.length);return(a=t)=>{if(!a)return``;let o=``;for(;;){let t=n(i),s=i;for(;s--;)if(o+=e[t[s]&r]||``,o.length>=a)return o}}}function uo(e){return function(t,n){let r=function(...r){let{promise:i,resolve:a,reject:o}=En(),s=` step_${e.generateUlid()} `,c={type:` step `,correlationId:s,stepName:t,args:r};this!==void 0&&this!==null&&this!==globalThis&&(c.thisVal=this);let l=n?.();return l&&(c.closureVars=l),e.invocationsQueue.set(s,c),B.debug(` Step consumer setup `,{correlationId:s,stepName:t,args:r}),e.e ...
Long lines were clipped for display.
{createCompiledModuleMapSource}
from
"#compiler/module-map.js"
;
import
{normalizeEsmImportSpecifier}
from
"#internal/application/import-specifier.js"
;
import
{createAuthoredAssetImportPlugin}
from
"#internal/authored-asset-import-plugin.js"
;
import
{createAuthoredModuleBundleError}
from
"#internal/authored-mo ..
.
2 `),moduleType:` js `}}}:null,...n.plugins,t.extensionScopeNamespace===void 0?null:createFixedNamespaceScopePlugin(t.extensionScopeNamespace),createAuthoredRelativeExtensionResolverPlugin({extensions:RESOLVE_EXTENSIONS}),createAuthoredAssetImportPlugin({packageRoot:i}),createAuthoredPackageTsConfigPathsPlugin({appPackageRoot:i,extensions:RESOLVE_EXTENSIONS}),createNodeEsmCompatBannerPlugin({includeRequire:!0}),n.packageBoundaryPlugin].filter(e=>e!==null);try{return(await buildSingleRolldownChunk(` authored module for "${e}"`,{cwd:i,input:e,platform:` node `,plugins:s,resolve:{conditionNames:[` eve - so ...
3 `).filter(e=>!e.startsWith(` //#region `)&&e!==`//#endregion`).join(`
4 `)}async function loadBundledAuthoredModule(t,n){let i=await bundleAuthoredModuleCode(t,n),a=normalizeExternalDependencies(n.externalDependencies),o=createHash(` sha1 `).update(t).update(` \0 `).update(a.join(` \0 `)).update(` \0 `).update(n.extensionScopeNamespace??``).update(` \0 `).update(i).digest(` hex `),s=join(resolveAuthoredPackageRoot(t),AUTHORED_MODULE_BUNDLE_DIRECTORY_PATH),l=join(s,` $ {o}. mjs `);existsSync(l)||(mkdirSync(s,{recursive:!0}),writeFileSync(l,i));try{return await import(` ${ createFileImportSpecifier (l)} ? v = ${o} `)}catch(e){throw createAuthoredModuleEvaluationError(t,e)}}function createI ...
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/src/internal/authored-module-loader.js View on unpkg · L3 Long lines were clipped for display.
Object.defineProperty,r
=
Object.getOwnPropertyDescriptor,i
=
Object.getOwnPropertyNames,a
=
Object
.
prototype
.hasOwnProperty,
o
=
(
e
,
t
)
=>
{
for
(
var
r
in
t)
n
(e,r,{get:t[r],enumerable:
!
0
})},
s
=
(
e
,
t
,
o
,
s
)
=>
{
if
(t
&&typeof
t
==
`object`
||typeof
t
==
`function`
)
for
(
let
c
of
i
(t))
!
a.
call
(e,c)
&&
c
!==
o
&&
n
(e,c,{
get
:()
=>
t[c],enumerable:
!
(s
=
r
(t,c))
||
s.enumerable});
return
e},
c
=
e
=>
s
(
n
({},
`__esModule`
,{value:
!
0
}),e),l
=
{};
o
(l,{
VercelOidcTokenError
:()
=>
u}),t.exports
=
c
(l);
var
u
=class
extends
Error
{
constructor
( ...
2 `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(` not a directory `)}catch{throw new f({code:` VERCEL_CLI_INVALID_CWD `,message:` Working directory $ { JSON . stringify ( e )} does not exist or is not a directory. `})}}function h(e,t){if(typeof t==` object `&&t){let n=t;if(n.code===` ENOENT `)return new f({code:` VERCEL_CLI_NOT_FOUND `,message:` Unable to find Vercel CLI command $ { JSON . stringify ( e . command )}. `,invocation:e,cause:t});if(n.code===` EACCES `||n.code===` EPERM `)return new f({code:` VERCEL_CLI_PERMISSION_DENIED `,message:` Permission denied while executing Vercel CLI command $ { J ...
3 `:10, n =typeof e == `string` ? ` \r ` : 13 ; return e [ e . length -1]=== t &&( e = e. slice ( 0 ,e. length - 1 )), e [ e . length -1]=== n &&( e = e. slice ( 0 ,e. length - 1 )), e }})), b = t ((( t , n ) => { let r = e ( `path` ),i = u (), a = e => {e = {cwd:process. cwd (),path:process.env[ i ()],execPath:process.execPath, ... e}; let t,n = r. resolve (e.cwd),a = []; for (;t !== n;)a. push (r. join (n, `node_modules/.bin` )),t = n,n = r. resolve (n, `..` ); let o = r. resolve (e.cwd,e.execPath, `..` ); return a. push (o),a. concat (e.path). join (r.delimiter)};n.exports = a,n.exports.default = a,n.exports. env = e => {e = {env:process.env, ... e}; let t = { ... e.env},r = i ({env:t}); return e.path = t[r],t[r] = n. exports (e),t}})), x = t ...
4 `);return _?(a.originalMessage=a.message,a.message=y):a=Error(y),a.shortMessage=v,a.command=c,a.escapedCommand=l,a.exitCode=s,a.signal=o,a.signalDescription=m,a.stdout=e,a.stderr=t,i!==void 0&&(a.all=i),` bufferedData `in a&&delete a.bufferedData,a.failed=!0,a.timedOut=!!u,a.isCanceled=d,a.killed=f&&!u,a}})),O=t(((e,t)=>{let n=[` stdin `,` stdout `,` stderr `],r=e=>n.some(t=>e[t]!==void 0),i=e=>{if(!e)return;let{stdio:t}=e;if(t===void 0)return n.map(t=>e[t]);if(r(e))throw Error(` It 's not possible to provide \` stdio \` in combination with one of ${n.map(e=>` \` ${e} \` `).join(`, `)}`);if(typeof t==`string` .. .
5 `)}})),q=t((e=>{var t=e&&e.__createBinding||(Object.create?(function(e,t,n,r){r===void 0&&(r=n);var i=Object.getOwnPropertyDescriptor(t,n);(!i||(` get `in i?!t.__esModule:i.writable||i.configurable))&&(i={enumerable:!0,get:function(){return t[n]}}),Object.defineProperty(e,r,i)}):(function(e,t,n,r){r===void 0&&(r=n),e[r]=t[n]})),n=e&&e.__setModuleDefault||(Object.create?(function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}):function(e,t){e.default=t}),r=e&&e.__importStar||function(e){if(e&&e.__esModule)return e;var r={};if(e!=null)for(var i in e)i!=="default"&&Object.prototyp ...
6 ` ). filter ( e => e), n = Math. min ( ... t. map ( e => e. length - e. trimStart (). length )), r = t. map ( e => e. slice (n)). map ( e => ` ` . repeat ( this .indent * 2 ) + e); for ( let e of r )this.content. push ( e )} compile (){let e = Function,t = this ?.args,n = [ ... ( this ?.content ?? [ `` ]). map ( e => ` ${ e }` )];return new e ( ... t,n. join ( `
7 ` ))}}})),re = t (( e => {Object. defineProperty (e, "__esModule" ,{value: ! 0 }),e.version =void 0 ,e.version = {major: 4 ,minor: 1 ,patch: 11 }})),ie = t (( e => { var t = e && e.__createBinding || (Object.create ? ( function ( e , t , n , r ){r ===void 0 && (r = n); var i = Object. getOwnPropertyDescriptor (t,n);( ! i || ( `get` in i ?! t.__esModule : i.writable || i.configurable)) && (i = {enumerable: ! 0 , get : function (){ return t[n]}}),Object. defineProperty (e,r,i)}) : ( function ( e , t , n , r ){r ===void 0 && (r = n),e[r] = t[n]})),n = e && e.__setModuleDefault || (Object.create ? ( function ( e , t ){Object. defineProperty (e, "default" ,{enumerable: ! 0 ,value:t})}) :function ( e , t ){e.default = t}),r = e && e. ...
High Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
dist/src/compiled/_chunks/workflow/token-util-BneBe0g5.js View on unpkg · L1 8 if (${n}.issues. length ) {
9 payload.issues = payload.issues. concat (${n}.issues. map ( iss => ({
11 path: iss.path ? [${i}, ... iss.path] : [${i}]
16 if (${n}.value === undefined ) {
18 newResult[${i}] = undefined ;
21 newResult[${i}] = ${n}.value;
Long lines were clipped for display.
1 import{i as e,t}from"./rolldown-runtime-8V8biNmG.js";import{t as n}from"./signal-exit-o3IPQwwv.js";var r=t(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=...
L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON....
L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),b=t(((t,n)=>{let r=e(`path`),i=u(),a=e=>{e=...
L4: `);return _?(a.originalMessage=a.message,a.message=y):a=Error(y),a.shortMessage=v,a.command=c,a.escapedCommand=l,a.exitCode=s,a.signal=o,a.signalDescription=m,a.stdout=e,a.stderr=t...
L5: `)}})),q=t((e=>{var t=e&&e.__createBinding||
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/src/compiled/_chunks/workflow/token-util-BneBe0g5.js View on unpkg · L1