Filesystem-first framework for durable backend AI agents that run anywhere.
AI Security Review
scanned 1mo ago · by lpm-firewall-ai
The aliased dependency on an older release of the same package is an unresolved supply-chain risk, and the package exposes substantial agent-driven modification capability. Direct inspection found no automatic lifecycle hook or confirmed credential exfiltration in this release.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Package installation resolves dependencies; self-modification features require runtime use.
Impact
An older nested release may introduce an unreviewed lifecycle path; the exposed agent capability can modify a configured repository and publish draft pull requests.
Mechanism
Aliased self-dependency and agent repository-modification capability.
AI rationale
The aliased dependency on an older release of the same package is an unresolved supply-chain risk, and the package exposes substantial agent-driven modification capability. Direct inspection found no automatic lifecycle hook or confirmed credential exfiltration in this release.
1import{a as e,i as t,t as n}from"../../_chunks/workflow/rolldown-runtime-DPpTSio4.js";import{D as r,O as i,T as a,Z as o,a as s,c,lt as l,o as u,ot as d,p as f,rt as p,s as m,w as ...
L2: `).map(e=>{let n=e.match(/^\s*at\s+(?:(.+?)\s+\()?(.+?):(\d+):(\d+)\)?$/);if(!n)return e;let[,i,a,o,s]=n;if(!a.includes(t))return e;let c=parseInt(o,10),l=parseInt(s,10),u=to(r,{li...
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
1import{i as e,t}from"./rolldown-runtime-DPpTSio4.js";import{t as n}from"./signal-exit-Dsy-TT0V.js";var r=t(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=...
L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON....
L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),b=t(((t,n)=>{let r=e(`path`),i=u(),a=e=>{e=...
...
L6: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ...
L7: `))}}})),re=t((e=>{Object.defineProperty
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/src/compiled/_chunks/workflow/token-util-B0OPd7oj.jsView on unpkg · L1
1import{i as e,t}from"./rolldown-runtime-DPpTSio4.js";import{t as n}from"./signal-exit-Dsy-TT0V.js";var r=t(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=...
L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON....
L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),b=t(((t,n)=>{let r=e(`path`),i=u(),a=e=>{e=...
L4: `);return _?(a.originalMessage=a.message,a.message=y):a=Error(y),a.shortMessage=v,a.command=c,a.escapedCommand=l,a.exitCode=s,a.signal=o,a.signalDescription=m,a.stdout=e,a.stderr=t...
L5: `)}})),q=t((e=>{var t=e&&e.__createBinding||
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
dist/src/compiled/_chunks/workflow/token-util-B0OPd7oj.jsView on unpkg · L1
1import{i as e,t}from"./rolldown-runtime-DPpTSio4.js";import{t as n}from"./signal-exit-Dsy-TT0V.js";var r=t(((e,t)=>{var n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=...
L2: `)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`not a directory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Working directory ${JSON....
L3: `:10,n=typeof e==`string`?`\r`:13;return e[e.length-1]===t&&(e=e.slice(0,e.length-1)),e[e.length-1]===n&&(e=e.slice(0,e.length-1)),e}})),b=t(((t,n)=>{let r=e(`path`),i=u(),a=e=>{e=...
L4: `);return _?(a.originalMessage=a.message,a.message=y):a=Error(y),a.shortMessage=v,a.command=c,a.escapedCommand=l,a.exitCode=s,a.signal=o,a.signalDescription=m,a.stdout=e,a.stderr=t...
L5: `)}})),q=t((e=>{var t=e&&e.__createBinding||
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/src/compiled/_chunks/workflow/token-util-B0OPd7oj.jsView on unpkg · L1
1import{AISDKError as e,APICallError as t,EmptyResponseBodyError as n,InvalidArgumentError as r,InvalidResponseDataError as i,JSONParseError as a,LoadAPIKeyError as o,NoSuchProvider...
L2: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ...
L3: `)}\n};`)(...Object.values(this.closed))}};const fn={major:4,minor:5,patch:4},F=A(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=fn;let r=e._...
L4: for (let i = 0; i < ${e}.issues.length; i++) {
...
L58: ${i}`,d++;return}if(_c(e,t,r)){f=e.slice(e.charCodeAt(t+6)===32?t+7:t+6,n)||void 0;return}if(r===105&&e.charCodeAt(t+1)===100&&e.charCodeAt(t+2)===58){let r=e.slice(e.charCodeA
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
26`,o?1+l:l),o=!0,s=!0,l=0,r=e.position;!x(h)&&h!==0;)h=e.input.charCodeAt(++e.position);I(e,r,e.position,!1)}return!0}function J(e,t){var n,r=e.tag,i=e.anchor,a=[],o,s=!1,c;for(e.anchor!==null&&(e.anchorMap[e.anchor]=a),c=e.input.charCodeAt(e.position);c!==0&&!(c!==45||(o=e.input.charCodeAt(e.position+1),!C(o)));){if(s=!0,e.position++,B(e,!0,-1)&&e.lineIndent<=t){a.push(null),c=e.input.charCodeAt(e.position);continue}if(n=e.line,Z(e,t,u,!1,!0),a.push(e.result),B(e,!0,-1),c=e.input.charCodeAt(e.position),(e.line===n||e.lineIndent>t)&&c!==0)N(e,`bad indentation of a sequence entry`);else if(e.lin ...
1import{a as e,i as t,t as n}from"../../_chunks/workflow/rolldown-runtime-DPpTSio4.js";import{D as r,O as i,T as a,Z as o,a as s,c,lt as l,o as u,ot as
1import{AISDKError as e,APICallError as t,EmptyResponseBodyError as n,InvalidArgumentError as r,InvalidResponseDataError as i,JSONParseError as a,LoadAPIKeyError as o,NoSuchProvider...
L2: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ...
L3: `)}\n};`)(...Object.values(this.closed))}};const fn={major:4,minor:5,patch:4},F=A(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=fn;let r=e._...
L4: for (let i = 0; i < ${e}.issues.length; i++) {
...
L58: ${i}`,d++;return}if(_c(e,t,r)){f=e.slice(e.charCodeAt(t+6)===32?t+7:t+6,n)||void 0;return}if(r===105&&e.charCodeAt(t+1)===100&&e.charCodeAt(t+2)===58){let r=e.slice(e.charCodeA
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
42`:``}function pe(e,t){return fe(e,n.extend({schema:a},t))}t.exports.dump=fe,t.exports.safeDump=pe})),require_js_yaml$1=__commonJSMin(((e,t)=>{var n=require_loader(),r=require_dumper();function i(e){return function(){throw Error(`Function `+e+` is deprecated and cannot be used.`)}}t.exports.Type=require_type(),t.exports.Schema=require_schema(),t.exports.FAILSAFE_SCHEMA=require_failsafe(),t.exports.JSON_SCHEMA=require_json(),t.exports.CORE_SCHEMA=require_core(),t.exports.DEFAULT_SAFE_SCHEMA=require_default_safe(),t.exports.DEFAULT_FULL_SCHEMA=require_default_full(),t.exports.load=n.load,t.export ...
43return `+str.trim()+`;
44}());`),eval(str)||{}}catch(e){if(wrap!==!1&&/(unexpected|identifier)/i.test(e.message))returnparse(str,options,!1);throwSyntaxError(e)}},stringify:function(){throwError(`stringifying JavaScript is not supported`)}}})),require_strip_bom_string=__commonJSMin(((e,t)=>{t.exports=function(e){returntypeof e==`string`&&e.charAt(0)===``?e.slice(1):e}})),require_utils=__commonJSMin((e=>{let t=require_strip_bom_string(),n=require_kind_of();e.define=function(e,t,n){Reflect.defineProperty(e,t,{enumerable:!1,configurable:!0,writable:!0,value:n})},e.isBuffer=function(e){returnn(e)===`buffer`},e.isObj ...
45`?e:e+`
Low
Eval
Package source references a known benign dynamic code generation pattern.
2`)}async function m(e){try{if(!(await(0,d.stat)(e)).isDirectory())throw Error(`notadirectory`)}catch{throw new f({code:`VERCEL_CLI_INVALID_CWD`,message:`Workingdirectory${JSON.stringify(e)} doesnotexistorisnota directory.`})}}function h(e,t){if(typeof t==`object`&&t){let n=t;if(n.code===`ENOENT`)return new f({code:`VERCEL_CLI_NOT_FOUND`,message:`UnabletofindVercelCLIcommand${JSON.stringify(e.command)}.`,invocation:e,cause:t});if(n.code===`EACCES`||n.code===`EPERM`)return new f({code:`VERCEL_CLI_PERMISSION_DENIED`,message:`PermissiondeniedwhileexecutingVercelCLIcommand${J ...
4`);return _?(a.originalMessage=a.message,a.message=y):a=Error(y),a.shortMessage=v,a.command=c,a.escapedCommand=l,a.exitCode=s,a.signal=o,a.signalDescription=m,a.stdout=e,a.stderr=t,i!==void 0&&(a.all=i),`bufferedData`in a&&delete a.bufferedData,a.failed=!0,a.timedOut=!!u,a.isCanceled=d,a.killed=f&&!u,a}})),O=t(((e,t)=>{let n=[`stdin`,`stdout`,`stderr`],r=e=>n.some(t=>e[t]!==void 0),i=e=>{if(!e)return;let{stdio:t}=e;if(t===void 0)return n.map(t=>e[t]);if(r(e))throw Error(`It's not possible to provide \`stdio\` in combination with one of ${n.map(e=>`\`${e}\``).join(`, `)}`);if(typeof t==`string` ...
5`)}})),q=t((e=>{var t=e&&e.__createBinding||(Object.create?(function(e,t,n,r){r===void 0&&(r=n);var i=Object.getOwnPropertyDescriptor(t,n);(!i||(`get`in i?!t.__esModule:i.writable||i.configurable))&&(i={enumerable:!0,get:function(){return t[n]}}),Object.defineProperty(e,r,i)}):(function(e,t,n,r){r===void 0&&(r=n),e[r]=t[n]})),n=e&&e.__setModuleDefault||(Object.create?(function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}):function(e,t){e.default=t}),r=e&&e.__importStar||function(e){if(e&&e.__esModule)return e;var r={};if(e!=null)for(var i in e)i!=="default"&&Object.prototyp ...