registry / eve / 0.58.1

eve@0.58.1

Filesystem-first framework for durable backend AI agents that run anywhere.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No install-time hook or concrete malware chain was found in the readable entrypoints, but the published dist is too large and nested to finish a clean review. Treat this as unresolved dual-use agent capability rather than a confirmed malicious package.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install does not run lifecycle hooks; remaining risk starts when a user runs the eve CLI or imports the agent runtime.

Impact

Unreviewed vendor files could hide extra network or code-loading behavior; intended tools can talk to model-provider APIs and run shell when the user operates the agent.

Mechanism

User-invoked agent CLI plus incomplete review of oversized vendored trees

AI rationale

Evidence

bin/eve.jsdist/src/internal/model-auth/vercel.jsdist/src/compiled/@vercel/blob/index.jsdist/src/compiled/@ai-sdk/openai/index.jsdist/src/node_modules/.pnpm/js-yaml@4.1.1/node_modules/js-yaml/dist/js-yaml.js

Network endpoints5

vercel.comapi.vercel.comai-gateway.vercel.shoidc.vercel.comapi.openai.com/v1

Decision evidence

public snapshot

AI called this Suspicious at 64.0% confidence as Dangerous Capability with high false-positive risk.

Evidence for warning

Published files include bin and a large dist tree, so install drops oversized compiled vendor bundles and a nested node_modules copy that cannot be fully reviewed.
The eve CLI bootstrap spawns Node and dynamically imports the compiled CLI when a user runs the bin.
Vercel model login posts OAuth traffic to vercel.com and ai-gateway.vercel.sh; HTTP basic channel auth compares passwords locally.
Vendored @vercel/blob posts OIDC tokens to oidc.vercel.com inside a minified bundle too large for complete review.
Vendored @ai-sdk/openai sends OPENAI_API_KEY bearer requests to api.openai.com.
A nested js-yaml 4.1.1 parser is shipped under dist/src/node_modules/.pnpm and is too large for complete behavioral review.

Evidence against

package.json has no preinstall, install, or postinstall hooks; scripts are build and test only.
Runtime dependencies are only nitro and undici; the npm:eve@0.30.8 alias is a named devDependency, not a registry-install self-lifecycle chain.
The main export only re-exports public APIs and does not run a payload on import.
Flagged hosts in the inspected files are first-party Vercel and OpenAI endpoints matching an agent framework.

Source & flagged code

13 flagged

dist/src/compiled/@vercel/blob/index.jsView file

28patternName = private_key_rsa severity = critical line = 28

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/compiled/@vercel/blob/index.jsView on unpkg · L28

28patternName = private_key_rsa severity = critical line = 28

Critical

Secret Pattern

RSA private key in dist/src/compiled/@vercel/blob/index.js

dist/src/compiled/@vercel/blob/index.jsView on unpkg · L28

bin/eve.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

3import { spawn } from "node:child_process";

4import { access, readdir, realpath, stat } from "node:fs/promises";

High

Child Process

Package source references child process execution.

bin/eve.jsView on unpkg · L2

5import { createRequire } from "node:module";

6import { dirname, resolve } from "node:path";

7import { fileURLToPath, pathToFileURL } from "node:url";

9const require = createRequire(import.meta.url);

10const packageJson = require("../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/eve.jsView on unpkg · L8

11const packageNodeEngine = packageJson.engines?.node;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/eve.jsView on unpkg · L2

12const bootstrapPackageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");

13let semverPromise;

15if (typeof packageNodeEngine !== "string") {

16 throw new Error("eve package.json must declare a valid engines.node range.");

17}

19function createBootstrapOptions(overrides = {}) {

20 const packageRoot = overrides.packageRoot ?? bootstrapPackageRoot;

22 return {

23 cliEntrypointPath:

24 overrides.cliEntrypointPath ?? resolve(packageRoot, "dist", "src", "cli", "run.js"),

25 packageRoot,

26 postBuildScriptPaths: overrides.postBuildScriptPaths ?? [

27 resolve(packageRoot, "scripts", "copy-compiled-assets.mjs"),

28 resolve(packageRoot, "scripts", "copy-runtime-assets.mjs"),

•matchType = normalized_sha256 matchedPackage = eve@0.51.0 matchedPath = bin/eve.js matchedIdentity = npm:ZXZl:0.51.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/eve.jsView on unpkg

dist/src/self-modification/proposal.jsView file

Lines 1-2javascript

1import{assertFullSha}from"./identifiers.js";import{gitOutput,runGitCommand}from"./git.js";import{createHash}from"node:crypto";import{shellQuote}from"#shared/shell-quote.js";const MAX_PROPOSAL_CHANGED_BYTES=1e6,MAX_PROPOSAL_CHANGED_FILES

dist/src/internal/model-auth/vercel.jsView file

Lines 1-1javascript

1import{readVercelSession,writeVercelSession}from"./store.js";import{mkdir,rm,stat}from"node:fs/promises";import{isErrnoCode,isObject}from"#shared/guards.js";import{join}from"node:path";import{homedir}from"node:os";import{setTimeout}

dist/src/compiled/just-secrets/windows.ps1View file

•path = dist/src/compiled/just-secrets/windows.ps1 kind = build_helper sizeBytes = 7146 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/src/compiled/just-secrets/windows.ps1View on unpkg

dist/src/compiled/shadcn-registry/index.jsView file

•path = dist/src/compiled/shadcn-registry/index.js kind = oversized_source_file sizeBytes = 9756205 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/src/compiled/shadcn-registry/index.jsView on unpkg

dist/src/node_modules/.pnpm/js-yaml@4.1.1/node_modules/js-yaml/dist/js-yaml.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/node_modules/.pnpm/js-yaml@4.1.1/node_modules/js-yaml/dist/js-yaml.js#virtual:normalized:round1View on unpkg

dist/src/channel/auth/http-basic.jsView file

•matchType = normalized_sha256 matchedPackage = eve@0.51.0 matchedPath = dist/src/channel/auth/http-basic.js matchedIdentity = npm:ZXZl:0.51.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/channel/auth/http-basic.jsView on unpkg

dist/src/compiled/@ai-sdk/openai/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = eve@0.55.0 matchedIdentity = npm:ZXZl:0.55.0 similarity = 0.783 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/compiled/@ai-sdk/openai/index.jsView on unpkg

Source & flagged code

13 flagged · loading source

dist/src/compiled/@vercel/blob/index.jsView file

28patternName = private_key_rsa severity = critical line = 28

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/compiled/@vercel/blob/index.jsView on unpkg · L28

28patternName = private_key_rsa severity = critical line = 28

Critical

Secret Pattern

RSA private key in dist/src/compiled/@vercel/blob/index.js

dist/src/compiled/@vercel/blob/index.jsView on unpkg · L28

bin/eve.jsView file

2L3: import { spawn } from "node:child_process"; L4: import { access, readdir, realpath, stat } from "node:fs/promises";

High

Child Process

Package source references child process execution.

bin/eve.jsView on unpkg · L2

Findings

4 Critical6 High6 Medium6 Low

CriticalCritical Secretdist/src/compiled/@vercel/blob/index.js

CriticalHardcoded Runtime Data Exfiltrationdist/src/internal/model-auth/vercel.js

CriticalPrevious Version Dangerous Deltadist/src/compiled/@ai-sdk/openai/index.js

CriticalSecret Patterndist/src/compiled/@vercel/blob/index.js

HighChild Processbin/eve.js

HighShell

HighCross File Remote Execution Contextbin/eve.js

HighSemantic Analysis Limiteddist/src/node_modules/.pnpm/js-yaml@4.1.1/node_modules/js-yaml/dist/js-yaml.js#virtual:normalized:round1

HighKnown Malware Source Similaritybin/eve.js

HighKnown Malware Source Similaritydist/src/channel/auth/http-basic.js

Medium

Affected versions and remediation

This report applies to eve@0.58.1.

See all versions of eve for other recorded verdicts.

Review the evidence and your use of eve@0.58.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 21:14:54.234Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

eve@0.58.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code