vercel-deploy

SUSPICIOUS: the stated purpose matches deployment, and the visible domains are Vercel-owned, but the actual deploy.sh implementation is missing and the 'no authentication required' claim is atypical for standard Vercel API usage. Main risk is external upload of local project contents with unclear file exclusions and unverifiable backend behavior, not confirmed malware.

No clear malware/backdoor behavior is evident in the shown snippet. The main security risk is supply-chain-style data egress: the script packages nearly all contents of the provided project directory (excluding only node_modules and .git) and uploads the resulting archive to a remote DEPLOY_ENDPOINT via HTTP POST. If DEPLOY_ENDPOINT is untrusted/misconfigured or the project contains sensitive files not excluded here, this can lead to data exfiltration or unintended distribution. Additionally, raw server responses are echoed and JSON fields are parsed via regex, creating log/data exposure and fragility risks rather than direct malicious code execution.