@blockrun/llm@3.13.6

BlockRun SDK - Pay-per-request AI (LLM, Image, Video, Music, Voice) via x402 on Base and Solana

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The wallet-related code implements payment for caller-initiated API requests: it handles a service payment challenge, signs the specified payment, and retries with the signature. The manifest has no install hook, and the inspected entrypoints provide no evidence of an unrelated or automatic transfer.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A caller makes a paid API request and the service responds with payment requirements.

Impact

This supports the package’s pay-per-request service. The inspected code does not establish hidden wallet transfers or credential theft.

Mechanism

The client signs an authorization using the challenge’s recipient and amount, then retries the request with the signature.

AI rationale

Evidence

package.jsondist/index.jsdist/index.cjs

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes the ESM and CommonJS bundles and defines no install lifecycle hook.
The ESM client handles payment requirements returned with a 402 response and uses their recipient and amount to build a payment authorization.
The ESM client retries the requested API call with the payment signature in a header.
The CommonJS bundle signs a transfer authorization for the specified recipient and amount; the Solana payment helper builds a transfer for the specified recipient and amount.

Evidence against

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 703 KB of source, external domains: base-rpc.publicnode.com, base.llamarpc.com, basescan.org, blockrun.ai, bridge.base.org, mainnet.base.org, pay.coinbase.com, sol.blockrun.ai, www.coinbase.com

Source & flagged code

5 flagged

dist/index.jsView file

Lines 1-21javascript

1// src/client.ts

2import { privateKeyToAccount } from "viem/accounts";

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index.jsView on unpkg · L1

4// src/types.ts

5var BlockrunError = class extends Error {

6 constructor(message) {

7 super(message);

8 this.name = "BlockrunError";

9 }

10};

11var RetiredEndpointError = class extends BlockrunError {

12 constructor(message) {

13 super(message);

14 this.name = "RetiredEndpointError";

15 }

16};

17var PaymentError = class extends BlockrunError {

18 constructor(message) {

19 super(message);

20 this.name = "PaymentError";

21 }

Lines 4779-4836javascript

4779 * Handle 402 response: parse requirements, sign payment, retry.

4780 */

4781 async handlePaymentAndRetry(url, body, response) {

4782 let paymentHeader = response.headers.get("payment-required");

4783 if (!paymentHeader) {

dist/index.cjsView file

Lines 3453-3493javascript

3453 negationComplexity: 0.01,

3454 domainSpecificity: 0.02,

3455 agenticTask: 0.04

3456 // Reduced - agentic signals influence tier selection, not dominate it

3457 },

3458 // Tier boundaries on weighted score axis

package.jsonView file

Lines 1-40json

2 "name": "@blockrun/llm",

3 "version": "3.13.6",

4 "type": "module",

5 "description": "BlockRun SDK - Pay-per-request AI (LLM, Image, Video, Music, Voice) via x402 on Base and Solana",

Source & flagged code

5 flagged · loading source

dist/index.jsView file

1// src/client.ts L2: import { privateKeyToAccount } from "viem/accounts"; L3: ... L3359: // Catalog refresh 2026-08-29 (V3.5). Every chain below names only models L3360: // the public catalog lists (GET https://blockrun.ai/api/v1/models). Ids the L3361: // gateway withholds (`hidden: true`) — kimi-k2.5/k2.6/k2.7, the grok-4-fast ... L3939: var SOLANA_USDC_DECIMALS = 6; L3940: var DEFAULT_COMPUTE_UNIT_PRICE_MICROLAMPORTS = 1; L3941: var DEFAULT_COMPUTE_UNIT_LIMIT = 8e3; ... L4102: transaction.sign([keypair]); L4103: return Buffer.from(transaction.serialize()).toString("base64"); L4104: };

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index.jsView on unpkg · L1

4799const paymentPayload = await createPaymentPayload( this.privateKey, this.account.address, details.recipient, details.amount, details.network || "eip155:8453", { resourceUrl: validateResourceUrl( details.resource?.url || `${this.apiUrl}/v1/chat/completions`, this.apiUrl ), resourceDescription: details.resource?.description || "BlockRun AI API call",

Medium

Stripped Provenance Metadata

The ESM client handles payment requirements returned with a 402 response and uses their recipient and amount to build a payment authorization.

dist/index.jsView on unpkg · L4799

4816const retryResponse = await this.fetchWithTimeout(url, { method: "POST", headers: { "Content-Type": "application/json", "User-Agent": USER_AGENT, "PAYMENT-SIGNATURE": pay

Findings

2 Critical4 Medium6 Low

CriticalWallet Draindist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumStripped Provenance Metadatadist/index.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @blockrun/llm@3.13.6.

See all versions of @blockrun/llm for other recorded verdicts.

Review the evidence and your use of @blockrun/llm@3.13.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 12:02:21.531Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.