registry / @blockrun/llm / 3.10.0

@blockrun/llm@3.10.0

⚠ Under review

BlockRun SDK - Pay-per-request AI (LLM, Image, Video, Music, Voice) via x402 on Base and Solana

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 428 KB of source, external domains: base.meowrpc.com, base.publicnode.com, basescan.org, blockrun.ai, bridge.base.org, mainnet.base.org, pay.coinbase.com, sol.blockrun.ai, www.coinbase.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-21javascript

1// src/client.ts

2import { privateKeyToAccount } from "viem/accounts";

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index.jsView on unpkg · L1

4// src/types.ts

5var BlockrunError = class extends Error {

6 constructor(message) {

7 super(message);

8 this.name = "BlockrunError";

9 }

10};

11var RetiredEndpointError = class extends BlockrunError {

12 constructor(message) {

13 super(message);

14 this.name = "RetiredEndpointError";

15 }

16};

17var PaymentError = class extends BlockrunError {

18 constructor(message) {

19 super(message);

20 this.name = "PaymentError";

21 }

dist/index.cjsView file

Lines 163-203javascript

163async function loadSolanaWeb3(what) {

164 try {

165 return await import("@solana/web3.js");

166 } catch (err) {

167

Source & flagged code

2 flagged · loading source

dist/index.jsView file

1// src/client.ts L2: import { privateKeyToAccount } from "viem/accounts"; L3: ... L69: var SOLANA_USDC_DECIMALS = 6; L70: var DEFAULT_COMPUTE_UNIT_PRICE_MICROLAMPORTS = 1; L71: var DEFAULT_COMPUTE_UNIT_LIMIT = 8e3; ... L163: resource: { L164: url: options.resourceUrl || "https://blockrun.ai/api/v1/chat/completions", L165: description: options.resourceDescription || "BlockRun AI API call", ... L232: transaction.sign([keypair]); L233: return Buffer.from(transaction.serialize()).toString("base64"); L234: };

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code