registry  /  @ai-sdk/provider-utils  /  5.0.3

@ai-sdk/provider-utils@5.0.3

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Network functions are explicit runtime helpers driven by caller-provided URLs, and the download helper includes SSRF-oriented redirect validation.

Static reason
No blocking static signals were detected.
Trigger
Consumer explicitly calls exported API or download helpers.
Impact
No package-initiated exfiltration, persistence, command execution, or filesystem mutation established.
Mechanism
Caller-directed HTTP requests and bounded blob downloads.
Rationale
Static source inspection found no install/import-time execution, credential exfiltration, filesystem mutation, shell execution, dynamic code loading, or persistence. The flagged network and environment primitives are package-aligned utilities invoked with consumer-supplied inputs.
Evidence
package.jsonsrc/index.tssrc/get-from-api.tssrc/post-to-api.tssrc/download-blob.tssrc/fetch-with-validated-redirects.tssrc/load-api-key.tsdist/index.jssrc/validate-download-url.tssrc/load-setting.tssrc/load-optional-setting.ts

Decision evidence

public snapshot
AI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for block
    Evidence against
    • `package.json` has no lifecycle hooks or bin entrypoint.
    • `src/index.ts` exports library utilities; no import-time network, filesystem, or process execution found.
    • `src/load-api-key.ts` and `src/load-setting.ts` only return caller-selected environment settings or throw errors.
    • `src/get-from-api.ts` and `src/post-to-api.ts` use caller-provided URLs and optional caller-provided fetch implementations.
    • `src/download-blob.ts` uses bounded downloads through redirect validation.
    • `src/fetch-with-validated-redirects.ts` validates every server-side redirect hop and blocks unsafe redirects.
    Behavioral surface
    Source
    EnvironmentVarsNetwork
    Supply chain
    HighEntropyStringsUrlStrings
    ManifestNo manifest risk signals triggered.
    scanned 134 file(s), 320 KB of source, external domains: json-schema.org

    Source & flagged code

    0 flagged
    No flagged code excerpts are attached to this scan.

    Findings

    2 Medium3 Low
    MediumNetwork
    MediumEnvironment Vars
    LowScripts Present
    LowHigh Entropy Strings
    LowUrl Strings