Vercel AI SDK

registrynpm

package nameai

maintainerVercel

The Vercel AI SDK (`ai` on npm) is the standard streaming AI library for React Server Components, Next.js Route Handlers, and edge functions. It provides `streamText`, `generateText`, and React hooks for building AI chat interfaces. Its adoption spans the majority of new Next.js AI applications built since 2023.

api usage

Checking Vercel AI SDK

ai 3.4.0 is a clean version with no known supply chain compromise. The response returns compromised: false with an empty sources array.

bash

curl "https://api.attestd.io/v1/check?product=ai&version=3.4.0" \
  -H "Authorization: Bearer YOUR_API_KEY"

json

{
  "product": "ai",
  "version": "3.4.0",
  "supported": true,
  "risk_state": "none",
  "supply_chain": {
    "compromised": false,
    "sources": [],
    "malware_type": null,
    "description": null,
    "advisory_url": null,
    "compromised_at": null,
    "removed_at": null
  },
  "last_updated": "2026-05-01T00:00:00Z"
}

attack surface

Why this package is monitored

Streaming AI SDK packages sit between the Next.js server and the LLM provider API. A compromised version can intercept streaming tokens before they are flushed to the client, capturing entire model responses without affecting the apparent functionality.

Attestd monitors ai using the following detection sources:

registry

Manually curated advisories in the Attestd registry, verified by a human analyst. Confidence 1.0.

osv

OSV.dev malicious-package advisories with IDs prefixed MAL-. Confidence 0.95.

npm_deprecation

npm package versions with deprecation messages containing targeted attack language such as malicious, backdoor, or compromised. Confidence 0.80.

Supply chain overview All npm packages OpenAI SDK (JS)Anthropic SDK (JS)LangChain (JS)Response fields