eve@0.67.2
Filesystem-first framework for durable backend AI agents that run anywhere.
AI Security Review
scanned 26d ago · by lpm-firewall-aieve@0.67.2 is a Vercel agent framework with no registry install lifecycle and no self-dependency chain. Auth, mock fixtures, and the CLI are package-aligned and user-invoked, so no concrete attack surface remains.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
No automatic install trigger. Agent tools and the eve CLI run only when the user or host application invokes them.
Impact
Installing the package does not execute an attack. Later use can run user-configured agent tools and authenticate to Vercel.
Mechanism
Lifecycle scripts do not mutate agent control files, harvest secrets, or fetch remote code. OAuth endpoints are rejected unless their origin is vercel.com or api.vercel.com.
AI rationale
eve@0.67.2 is a Vercel agent framework with no registry install lifecycle and no self-dependency chain. Auth, mock fixtures, and the CLI are package-aligned and user-invoked, so no concrete attack surface remains.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no preinstall, install, or postinstall hooks; scripts are build, test, and typecheck only.
- bin/eve.js is a user-invoked CLI that loads the local package and may spawn a child process only after the eve command runs.
- Vercel model login accepts OAuth endpoints only when their origin is https://vercel.com or https://api.vercel.com.
- Mock model fixtures parse prompt text into sample tool inputs for tests and do not send network requests.
- HTTP basic channel auth compares a caller-supplied username and password locally with a timing-safe hash and does not forward them.
Evidence against
- The CLI uses child_process.spawn and the framework includes agent tools such as bash and file writes, but those run only when an application or the eve command is used.
- Vercel login stores refresh tokens under the user home directory and calls Vercel AI Gateway, which matches the documented product rather than a hidden recipient.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Oversized source lightweight scan
dist/src/compiled/shadcn-registry/index.js9.25 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsDynamicRequireHighEntropyStringsMinifiedUrlStringsbun.shclassic.yarnpkg.comdeno.comdocs.npmjs.comgithub.compnpm.ioraw.githubusercontent.comui.shadcn.comyarnpkg.com
Source & flagged code
10 flagged · loading sourcebin/eve.jsView file
2L3: import { spawn } from "node:child_process";
L4: import { access, readdir, realpath, stat } from "node:fs/promises";
High
2Cross-file remote execution chain: bin/eve.js spawns dist/src/compiled/@ai-sdk/anthropic/index.js; helper contains network access plus dynamic code execution.
L2:
L3: import { spawn } from "node:child_process";
L4: import { access, readdir, realpath, stat } from "node:fs/promises";
...
L9: const require = createRequire(import.meta.url);
L10: const packageJson = require("../package.json");
L11: const packageNodeEngine = packageJson.engines?.node;
...
L354: }
L355: process.exitCode = 1;
L356: } finally {
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/eve.jsView on unpkg · L2•matchType = normalized_sha256
matchedPackage = eve@0.51.0
matchedPath = bin/eve.js
matchedIdentity = npm:ZXZl:0.51.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/eve.jsView on unpkg8L9: const require = createRequire(import.meta.url);
L10: const packageJson = require("../package.json");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/eve.jsView on unpkg · L8dist/src/self-modification/proposal.jsView file
1import{assertFullSha}from"./identifiers.js";import{gitOutput,runGitCommand}from"./git.js";import{createHash}from"node:crypto";import{shellQuote}from"#shared/shell-quote.js";const M...
L2: `)&&!e.includes(`\r`)&&!e.split(`/`).some(e=>e===``||e===`.`||e===`..`)}function proposalMode(e,t){if(e===`100644`||e===`100755`)return e;throw Error(`Self-modification proposal us...
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/src/self-modification/proposal.jsView on unpkg · L1dist/src/internal/model-auth/vercel.jsView file
1import{readVercelSession,writeVercelSession}from"./store.js";import{mkdir,rm,stat}from"node:fs/promises";import{isErrnoCode,isObject}from"#shared/guards.js";import{join}from"node:p...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/src/internal/model-auth/vercel.jsView on unpkg · L1dist/src/compiled/just-secrets/windows.ps1View file
•path = dist/src/compiled/just-secrets/windows.ps1
kind = build_helper
sizeBytes = 7146
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
dist/src/compiled/just-secrets/windows.ps1View on unpkgdist/src/compiled/shadcn-registry/index.jsView file
•path = dist/src/compiled/shadcn-registry/index.js
kind = oversized_source_file
sizeBytes = 9702195
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/src/compiled/shadcn-registry/index.jsView on unpkgdist/src/runtime/agent/mock-model-fixtures.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/src/runtime/agent/mock-model-fixtures.js#virtual:normalized:round1View on unpkgdist/src/channel/auth/http-basic.jsView file
•matchType = normalized_sha256
matchedPackage = eve@0.51.0
matchedPath = dist/src/channel/auth/http-basic.js
matchedIdentity = npm:ZXZl:0.51.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/channel/auth/http-basic.jsView on unpkgFindings
1 Critical6 High6 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/src/internal/model-auth/vercel.js
HighChild Processbin/eve.js
HighShell
HighCross File Remote Execution Contextbin/eve.js
HighSemantic Analysis Limiteddist/src/runtime/agent/mock-model-fixtures.js#virtual:normalized:round1
HighKnown Malware Source Similaritybin/eve.js
HighKnown Malware Source Similaritydist/src/channel/auth/http-basic.js
MediumDynamic Requirebin/eve.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/src/compiled/just-secrets/windows.ps1
MediumOversized Source Filedist/src/compiled/shadcn-registry/index.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowWeak Cryptodist/src/self-modification/proposal.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to eve@0.67.2.
See all versions of eve for other recorded verdicts.
- Review the evidence and your use of eve@0.67.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.