registry / vercel / 54.20.0

vercel@54.20.0

The command-line interface for Vercel

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a Vercel CLI with expected authenticated API, telemetry, deployment, and explicit agent-assist commands.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs vercel/vc CLI commands

Impact

Expected project/config changes and Vercel account operations when invoked by the user

Mechanism

user-invoked CLI operations and Vercel API calls

Rationale

Static inspection shows no install-time execution, no import-time credential exfiltration, and no unconsented lifecycle mutation of AI-agent control surfaces. Risky primitives are tied to normal Vercel CLI functionality or explicit, prompt-gated user commands.

Evidence

package.jsondist/vc.jsdist/index.jsdist/commands-bulk.jsAGENTS.mdCLAUDE.mdvercel.jsonVercel global config/auth/telemetry filesVercel trace cache files

Network endpoints6

api.vercel.comvercel.comtelemetry.vercel.com/api/vercel-cli/v1/eventsregistry.npmjs.org/-/package/${name}/dist-tagsskills.sh/api/searchai-gateway.vercel.sh/v1/models

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/commands-bulk.js has user-invoked agent init that can write AGENTS.md or CLAUDE.md after confirmation/--yes
dist/commands-bulk.js skills command can call npx skills add after explicit selection or --yes
dist/index.js reads VERCEL_TOKEN/--token and sends authenticated CLI requests to Vercel APIs

Evidence against

package.json has no npm lifecycle hooks; only bin vc/vercel points to dist/vc.js
dist/vc.js only enables compile cache, handles --version/--help, then imports dist/index.js
AI-agent file writes are under explicit vercel agent init command and prompt-gated in TTY, not install/import-time
Network endpoints are package-aligned: api.vercel.com, vercel.com, telemetry.vercel.com, registry.npmjs.org
No evidence of credential harvesting to unrelated hosts or unconsented foreign control-surface mutation

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 125 file(s), 7.10 MB of source, external domains: 127.0.0.1, ai-gateway.vercel.sh, api.example.com, api.vercel.com, app.example.com, backend.internal, bitbucket.org, codeload.github.com, cursor.sh, dogs.are.great, err.sh, example.com, example.vercel.app, examples.vercel.sh, feross.org, fetch.spec.whatwg.org, gist.githubusercontent.com, github.com, gitlab.com, internal.example.com, mcp.vercel.com, mimesniff.spec.whatwg.org, mozilla.github.io, my-app-xxxxx.vercel.app, new-api.example.com, now.sh, openapi-internal.vercel.sh, openapi.vercel.sh, raw.githubusercontent.com, registry.npmjs.org, sites.google.com, stackoverflow.com, telemetry.vercel.com, tools.ietf.org, vercel.com, vercel.link, w3c.github.io, websockets.spec.whatwg.org, www.example.com, www.w3.org, your-project-abc123.vercel.app

Oversized source lightweight scan

dist/chunks/chunk-RB7WQKNC.js2.37 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsEvalShellDynamicRequireHighEntropyStringsUrlStringsbitbucket.orgfeross.orggithub.comgitlab.comstackoverflow.comtools.ietf.orgvercel.comvercel.linkwww.w3.org

Source & flagged code

10 flagged

dist/index.jsView file

Lines 1-22javascript

1import { createRequire as __createRequire } from 'node:module';

2import { fileURLToPath as __fileURLToPath } from 'node:url';

3import { dirname as __dirname_ } from 'node:path';

4const require = __createRequire(import.meta.url);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L2

5const __filename = __fileURLToPath(import.meta.url);

6const __dirname = __dirname_(__filename);

7import {

8 help

9} from "./chunks/chunk-LFODAB54.js";

10import {

11 box,

12 canAutoUpdate,

13 did_you_mean_default,

14 executeUpgrade,

15 hasAutoUpdatePreference,

16 login,

17 matchesCliApiTag,

18 require_ci_info,

19 setAutoUpdate,

20 tryOpenApiFallback

21} from "./chunks/chunk-JDO6BSKN.js";

22import {

Lines 444-484javascript

444 });

445 });

446 }

447 module.exports = { fetchDistTags: fetchDistTags2 };

448 }

449});

450

451// src/index.ts

452var import_error_utils3 = __toESM(require_dist(), 1);

453var import_fs_extra2 =

dist/commands-bulk.jsView file

2import { fileURLToPath as __fileURLToPath } from 'node:url'; L3: import { dirname as __dirname_ } from 'node:path'; L4: const require = __createRequire(import.meta.url); ... L471: import { L472: require_execa L473: } from "./chunks/chunk-24FCBXI4.js"; ... L699: - Use AI Gateway for model routing, set AI_GATEWAY_API_KEY, using a model string (e.g. 'anthropic/claude-sonnet-4.6'), Gateway is already default in AI SDK L700: needed. Always curl https://ai-gateway.vercel.sh/v1/models first; never trust model IDs from memory L701: - For durable agent loops or untrusted code: use Workflow (pause/resume/state) + Sandbox; use Vercel MCP for secure infra access`; ... L790: telemetry2.trackCliFlagHelp("agent"); L791: output_manager_default.print(help(agentCommand, { columns: client.stderr.columns })); L792: return 2;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/commands-bulk.jsView on unpkg · L2

2Trigger-reachable chain: manifest.bin -> dist/vc.js -> dist/index.js -> dist/commands-bulk.js L2: import { fileURLToPath as __fileURLToPath } from 'node:url'; L3: import { dirname as __dirname_ } from 'node:path'; L4: const require = __createRequire(import.meta.url); ... L471: import { L472: require_execa L473: } from "./chunks/chunk-24FCBXI4.js"; ... L699: - Use AI Gateway for model routing, set AI_GATEWAY_API_KEY, using a model string (e.g. 'anthropic/claude-sonnet-4.6'), Gateway is already default in AI SDK L700: needed. Always curl https://ai-gateway.vercel.sh/v1/models first; never trust model IDs from memory L701: - For durable agent loops or untrusted code: use Workflow (pause/resume/state) + Sandbox; use Vercel MCP for secure infra access`; ... L790: telemetry2.trackCliFlagHelp("agent"); L791: output_manager_default.print(help(agentCommand, { columns: client.stderr.columns })); L792: return 2;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/get-latest-worker.cjsView file

Lines 1-36javascript

1/**

2 * This file is spawned in the background and checks npm for the latest version

3 * of the CLI, then writes the version to the cache file.

4 *

5 * NOTE: Since this file runs asynchronously in the background, it's possible

6 * for multiple instances of this file to be running at the same time leading

7 * to a race condition where the most recent instance will overwrite the

8 * previous cache file resetting the `notified` flag and cause the update

9 * notification to appear for multiple consequetive commands. Not the end of

10 * the world, but something to be aware of.

11 *

dist/chunks/chunk-RB7WQKNC.jsView file

•path = dist/chunks/chunk-RB7WQKNC.js kind = oversized_source_file sizeBytes = 2484789 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunks/chunk-RB7WQKNC.jsView on unpkg

Source & flagged code

10 flagged · loading source

dist/index.jsView file

464import { dirname, parse as parsePath, resolve as resolvePath } from "path"; L465: import { spawn } from "child_process"; L466: var import_fetch_dist_tags = __toESM(require_fetch_dist_tags(), 1);

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L464

2Cross-file remote execution chain: dist/index.js spawns dist/chunks/chunk-JDO6BSKN.js; helper contains network access plus dynamic code execution. L2: import { fileURLToPath as __fileURLToPath } from 'node:url'; L3: import { dirname as __dirname_ } from 'node:path'; L4: const require = __createRequire(import.meta.url); ... L118: if (stream == null) L119: stream = process.stdout; L120: if (callback == null) ... L141: var paths = __require("path"); L142: var isWinOS = /^win/i.test(process.platform); L143: function normalize_path(path2) { ... L188: const object = {}; L189: object.cache = () => process.env.XDG_CACHE_HOME || path2.join(osPaths.home() || osPaths.temp(), ".cache"); L190: object.config = () => process.env.XDG_CONFIG_HOME || path2.join(osPaths.home() || osPaths.temp(), ".config");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L2

dist/commands-bulk.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/commands-bulk.jsView on unpkg · L2

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/commands-bulk.jsView on unpkg · L2

471import { L472: require_execa L473: } from "./chunks/chunk-24FCBXI4.js";

High

Shell

Package source references shell execution.

dist/commands-bulk.jsView on unpkg · L471

4357); L4358: const testUrl = `https://${deployment.url}${subpath}`; L4359: output_manager_default.log(`${import_chalk18.default.bold("Deployment URL:")} ${link_default(testUrl)}`); ... L4368: if (run3) { L4369: const proc = await (0, import_execa.default)(run3, [testUrl], { L4370: stdio: "inherit", ... L4372: env: { L4373: ...process.env, L4374: HOST: deployment.url,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands-bulk.jsView on unpkg · L4357

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands-bulk.jsView on unpkg · L2

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/commands-bulk.jsView on unpkg · L2

dist/get-latest-worker.cjsView file

16L17: const { mkdirSync, writeFileSync } = require('fs'); L18: const { access, mkdir, readFile, unlink, writeFile } = require('fs/promises');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/get-latest-worker.cjsView on unpkg · L16

dist/chunks/chunk-RB7WQKNC.jsView file

•path = dist/chunks/chunk-RB7WQKNC.js kind = oversized_source_file sizeBytes = 2484789 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunks/chunk-RB7WQKNC.jsView on unpkg

Findings

2 Critical6 High5 Medium8 Low

CriticalCredential Exfiltrationdist/commands-bulk.js

CriticalTrigger Reachable Dangerous Capabilitydist/commands-bulk.js

HighChild Processdist/index.js

HighShelldist/commands-bulk.js

HighSame File Env Network Executiondist/commands-bulk.js

HighSandbox Evasion Gated Capabilitydist/commands-bulk.js

HighCross File Remote Execution Contextdist/index.js

HighOversized Source Filedist/chunks/chunk-RB7WQKNC.js

MediumDynamic Requiredist/get-latest-worker.cjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowWeak Cryptodist/commands-bulk.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

10 flagged

dist/index.jsView file

Lines 1-22javascript

1import { createRequire as __createRequire } from 'node:module';

2import { fileURLToPath as __fileURLToPath } from 'node:url';

3import { dirname as __dirname_ } from 'node:path';

4const require = __createRequire(import.meta.url);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L2

5const __filename = __fileURLToPath(import.meta.url);

6const __dirname = __dirname_(__filename);

7import {

8 help

9} from "./chunks/chunk-LFODAB54.js";

10import {

11 box,

12 canAutoUpdate,

13 did_you_mean_default,

14 executeUpgrade,

15 hasAutoUpdatePreference,

16 login,

17 matchesCliApiTag,

18 require_ci_info,

19 setAutoUpdate,

20 tryOpenApiFallback

21} from "./chunks/chunk-JDO6BSKN.js";

22import {

Lines 444-484javascript

444 });

445 });

446 }

447 module.exports = { fetchDistTags: fetchDistTags2 };

448 }

449});

450

451// src/index.ts

452var import_error_utils3 = __toESM(require_dist(), 1);

453var import_fs_extra2 =

dist/commands-bulk.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/commands-bulk.jsView on unpkg · L2

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/get-latest-worker.cjsView file

Lines 1-36javascript

1/**

2 * This file is spawned in the background and checks npm for the latest version

3 * of the CLI, then writes the version to the cache file.

4 *

5 * NOTE: Since this file runs asynchronously in the background, it's possible

6 * for multiple instances of this file to be running at the same time leading

7 * to a race condition where the most recent instance will overwrite the

8 * previous cache file resetting the `notified` flag and cause the update

9 * notification to appear for multiple consequetive commands. Not the end of

10 * the world, but something to be aware of.

11 *

dist/chunks/chunk-RB7WQKNC.jsView file

•path = dist/chunks/chunk-RB7WQKNC.js kind = oversized_source_file sizeBytes = 2484789 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunks/chunk-RB7WQKNC.jsView on unpkg