The malicious @amedit/vercel-builder-probe package, when executed as a Vercel Builder, reads sensitive environment variables such as RUNTIME_CACHE_HEADERS, VERCEL_DEPLOYMENT_KEY, and VERCEL_OIDC_TOKEN and logs their raw JWTs and deployment keys to build logs. It then creates a forged JWT by HMAC-signing with the installer's deployment key and sends this forged token to a hardcoded third-party Vercel internal endpoint (iad1.suspense-cache.vercel-infra.com) using foreign team/project/deployment identifiers. This results in two main harms: exposure of secrets in logs and unauthorized use of the installer's credentials to interact with another party's Vercel infrastructure, potentially causing abuse-policy violations. The presence of the '[P1216]' log tag and hardcoded foreign IDs suggests this is a research or abuse probe rather than legitimate functionality. The package compromises the host system fully, necessitating secret rotation and removal of the package.

Systems with this package installed or running are considered fully compromised. Sensitive secrets and keys stored on the system are exposed in build logs and may be accessible to unauthorized parties. The installer's Vercel account is used to forge JWTs and send unauthorized requests, risking abuse-policy enforcement and potential account suspension or other penalties. The compromise extends beyond data leakage to potential misuse of the installer's Vercel resources.

No official patch or fix is indicated. Immediate removal of the @amedit/vercel-builder-probe package is required. All secrets and keys stored on affected systems should be rotated immediately from a separate, trusted environment. Due to the full compromise risk, assume the system is untrusted and consider rebuilding or thoroughly cleaning the environment. Monitor Vercel accounts for unauthorized activity and report any abuse to Vercel support. Check vendor advisories or trusted sources for updates or official guidance.