vercel-deploy

SUSPICIOUS. The stated purpose matches deployment to Vercel and the only named domains are official Vercel domains, which supports legitimacy. However, the real behavior is delegated to an unseen shell script, and the 'no authentication required' claim cannot be validated against standard Vercel API usage from the provided text. Main risk is external upload of project contents with incomplete visibility into exact data flow, not confirmed malware.

No clear malware/backdoor behavior is evident in the shown snippet. The main security risk is supply-chain-style data egress: the script packages nearly all contents of the provided project directory (excluding only node_modules and .git) and uploads the resulting archive to a remote DEPLOY_ENDPOINT via HTTP POST. If DEPLOY_ENDPOINT is untrusted/misconfigured or the project contains sensitive files not excluded here, this can lead to data exfiltration or unintended distribution. Additionally, raw server responses are echoed and JSON fields are parsed via regex, creating log/data exposure and fragility risks rather than direct malicious code execution.