vercel-deploy

No clear malware/backdoor behavior is evident in the shown snippet. The main security risk is supply-chain-style data egress: the script packages nearly all contents of the provided project directory (excluding only node_modules and .git) and uploads the resulting archive to a remote DEPLOY_ENDPOINT via HTTP POST. If DEPLOY_ENDPOINT is untrusted/misconfigured or the project contains sensitive files not excluded here, this can lead to data exfiltration or unintended distribution. Additionally, raw server responses are echoed and JSON fields are parsed via regex, creating log/data exposure and fragility risks rather than direct malicious code execution.