registry / @blockrun/llm / 3.12.0

@blockrun/llm@3.12.0

⚠ Under review

BlockRun SDK - Pay-per-request AI (LLM, Image, Video, Music, Voice) via x402 on Base and Solana

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 663 KB of source, external domains: base-rpc.publicnode.com, base.llamarpc.com, basescan.org, blockrun.ai, bridge.base.org, mainnet.base.org, pay.coinbase.com, sol.blockrun.ai, www.coinbase.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-21javascript

1// src/client.ts

2import { privateKeyToAccount } from "viem/accounts";

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index.jsView on unpkg · L1

4// src/types.ts

5var BlockrunError = class extends Error {

6 constructor(message) {

7 super(message);

8 this.name = "BlockrunError";

9 }

10};

11var RetiredEndpointError = class extends BlockrunError {

12 constructor(message) {

13 super(message);

14 this.name = "RetiredEndpointError";

15 }

16};

17var PaymentError = class extends BlockrunError {

18 constructor(message) {

19 super(message);

20 this.name = "PaymentError";

21 }

dist/index.cjsView file

Lines 3519-3559javascript

3519async function loadSolanaWeb3(what) {

3520 try {

3521 return await import("@solana/web3.js");

3522 } catch (err) {

Source & flagged code

2 flagged · loading source

dist/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code