vike@0.4.266
(Replaces Next.js/Nuxt) 🔨 Build mission-critical applications with stability and development freedom.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package embeds the same AI-directed request to load an external URL in both AGENTS.md and package.json, crossing the explicit no-network review boundary. The inspected runtime behavior is otherwise consistent with a delayed local skill check and does not make that request.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An AI agent reviews or uses the package and reads its AGENTS.md or package.json.
Impact
Could steer an AI reviewer into unauthorized network access; no package code was found performing that request.
Mechanism
The package repeats an instruction to load vike.dev/llms.txt, attempting to cross the review's explicit no-network boundary.
Attack narrative
The package contains an AI-directed instruction in both AGENTS.md and package.json to load external documentation. This attempts to override the review's explicit no-network boundary. The inspected runtime code does not itself contact that host; the malicious finding is the review-directed boundary escape.
AI rationale
The package embeds the same AI-directed request to load an external URL in both AGENTS.md and package.json, crossing the explicit no-network review boundary. The inspected runtime behavior is otherwise consistent with a delayed local skill check and does not make that request.
Evidence
AGENTS.mdpackage.json
Network endpoints1
vike.dev
Decision evidence
public snapshotAI called this Malicious at 86.0% confidence as Malware with low false-positive risk.
Evidence for block
- Packaged AGENTS.md directs AI agents to load vike.dev/llms.txt, an external resource, despite this review's no-network boundary.
- package.json repeats the AI-directed instruction in its metadata, making the boundary-escape directive part of the package manifest.
Evidence against
- The manifest declares no install lifecycle scripts; its scripts are for development, building, and releases.
- The new skill hint runs after Vite's dev server starts and checks for a Vike skill before logging a hint.
- The skill check reads local files and invokes git only to find the repository root; the inspected code does not write agent configuration or make network requests.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggeddist/server/runtime/createDevMiddleware.jsView file
4const p = '../../node/createDevMiddleware.js';
L5: const { createDevMiddleware } = await import(/*webpackIgnore: true*/ /* @vite-ignore */ p);
L6: return createDevMiddleware(...args);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/server/runtime/createDevMiddleware.jsView on unpkg · L4dist/node/vite/plugins/build/pluginDistFileNames.jsView file
2// Attempt to preserve file structure of `.page.js` files:
L3: // - https://github.[redacted]
L4: // - Blocker: https://github.com/rollup/rollup/issues/4724
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/node/vite/plugins/build/pluginDistFileNames.jsView on unpkg · L2package.jsonView file
Findings
1 Critical2 High4 Medium5 Low
CriticalManifest Confusionpackage.json
HighPrevious Version Dangerous Deltadist/node/vite/plugins/pluginDev/logSkillHint.js
HighAi Review EvidenceAGENTS.md
MediumDynamic Requiredist/server/runtime/createDevMiddleware.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/node/vite/plugins/build/pluginDistFileNames.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to vike@0.4.266.
See all versions of vike for other recorded verdicts.
- Avoid installing vike@0.4.266. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.