@blockrun/llm@3.15.0
TypeScript SDK for BlockRun - every frontier model behind one OpenAI-compatible client. Pay with a BlockRun API key or per-call in USDC. Smart routing picks the cheapest capable model. No rate limits.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package is not an install-time malware chain, but its automatic signing of server-controlled payment terms and cross-application wallet-key discovery create a concrete high-impact wallet-drain capability. The absence of lifecycle hooks and evidence of covert exfiltration supports a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A caller invokes a paid client method with a wallet, or explicitly calls wallet discovery or import APIs.
Impact
A compromised or malicious configured API server could obtain a signed transfer authorization for an excessive amount; explicit import can copy another application's discovered wallet key into BlockRun storage.
Mechanism
Automatic signing of unbounded server-supplied payment details and explicit cross-application wallet discovery.
AI rationale
The package is not an install-time malware chain, but its automatic signing of server-controlled payment terms and cross-application wallet-key discovery create a concrete high-impact wallet-drain capability. The absence of lifecycle hooks and evidence of covert exfiltration supports a warning rather than a block.
Evidence
dist/index.js.blockrun/.session<home>/.*/wallet.json
Network endpoints2
blockrun.aiapi.blockrun.ai
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
- Runtime payment handling signs a USDC transfer authorization using the recipient and amount supplied in a 402 response, without a local spending limit.
- Exported wallet-discovery functions enumerate hidden home-directory application folders and read wallet.json private keys.
- The package can write a selected discovered private key into its own session file when the caller invokes wallet import.
Evidence against
- package.json has no preinstall, install, postinstall, or other lifecycle hook.
- The wallet scanning and import routines are exported functions, not import-time behavior.
- Network requests and payment signing are part of the package's stated API-client and payment functionality; no secret exfiltration endpoint was found.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/index.jsView file
86}
L87: function validatePrivateKey(key) {
L88: if (typeof key !== "string") {
...
L113: throw new Error(
L114: `Invalid protocol: ${parsed.protocol}. Use http:// or https://`
L115: );
...
L181: }
L182: const key = options.apiKey ?? (options.privateKey === void 0 && typeof process !== "undefined" ? process.env?.BLOCKRUN_API_KEY : void 0);
L183: if (key === void 0) return void 0;
...
L239: try {
L240: body = await response.json();
L241: } catch {
Critical
Wallet Drain
Source uses private key material to transfer cryptocurrency funds.
dist/index.jsView on unpkg · L864931async handlePaymentAndRetry(url, body, response) {
let paymentHeader = response.headers.get("payment-required");
if (!paymentHeader) {
try {
const respBody = await response.json();
if (respBody.x402 || respBody.accepts) {
paymentHeader = btoa(JSON.stringify(respBody));
}
} catch (parseError) {
console.debug("Failed to parse payment header from response body", parseError);
}
}
if (!paymentHeader) {
throw new PaymentError("402 response but no payment requirements found");
}
const paymentRequired = parse
Medium
Stripped Provenance Metadata
Runtime payment handling signs a USDC transfer authorization using the recipient and amount supplied in a 402 response, without a local spending limit.
dist/index.jsView on unpkg · L4931Findings
2 Critical6 Medium4 Low
CriticalWallet Draindist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumStripped Provenance Metadatadist/index.js
MediumStripped Provenance Metadatadist/index.js
MediumStripped Provenance Metadatadist/index.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @blockrun/llm@3.15.0.
See all versions of @blockrun/llm for other recorded verdicts.
- Review the evidence and your use of @blockrun/llm@3.15.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.