The @amedit/vercel-builder-probe npm package contains malicious code that, when used as a @vercel/build-utils Builder in a Vercel deployment pipeline, leaks sensitive environment variables including JWTs and deployment keys into build logs. It also forges JWT signatures using the installer's deployment key and sends unauthorized requests to a third party's internal Vercel endpoint. This exposes the installer's secrets and risks abuse-policy enforcement actions. The package is considered fully compromising to any system where it is installed.