registry / @blockrun/llm / 3.16.0

@blockrun/llm@3.16.0

TypeScript SDK for BlockRun - every frontier model behind one OpenAI-compatible client. Pay with a BlockRun API key or per-call in USDC. Smart routing picks the cheapest capable model. No rate limits.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The flagged wallet-signing behavior is part of the package's stated payment functionality and is driven by payment requirements returned during a paid request. The manifest has no install hook, and the inspected ESM and CommonJS paths show no separate attack behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A caller makes a paid SDK request and receives payment requirements in a 402 response.

Impact

The wallet authorizes the requested payment; the inspected source does not establish an unrelated or hidden transfer.

Mechanism

The client signs a short-lived USDC authorization using the caller's wallet and the recipient and amount in those payment requirements.

AI rationale

Evidence

package.jsondist/index.jsdist/index.cjs

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest describes per-call USDC payments as SDK functionality and has no install lifecycle script.
The ESM payment builder signs a USDC authorization from the caller's wallet to a supplied recipient for a supplied amount.
The ESM runtime builds that payment from requirements parsed from a 402 response during a paid request.
The CommonJS entrypoint follows the same 402 payment flow.

Evidence against

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 742 KB of source, external domains: api.blockrun.ai, base-rpc.publicnode.com, base.llamarpc.com, basescan.org, blockrun.ai, bridge.base.org, mainnet.base.org, pay.coinbase.com, sol.blockrun.ai, user.blockrun.ai, www.coinbase.com

Source & flagged code

5 flagged

dist/index.jsView file

Lines 66-106javascript

66 if (temperature === void 0 || temperature === null) {

67 return;

68 }

69 if (typeof temperature !== "number") {

70 throw new Error("temperature must be a number");

71 }

72 if (temperature < 0 || temperature > 2) {

73 throw new Error("temperature must be between 0 and 2");

74 }

75}

76function validateTopP(topP) {

77 if (topP === void 0 || topP === null) {

78 return;

79 }

80 if (typeof topP !== "number") {

81 throw new Error("topP must be a number");

82 }

83 if (topP < 0 || topP > 1) {

84 throw new Error("topP must be between 0 and 1");

85 }

86}

87function validatePrivateKey(key) {

88 if (typeof key !== "string") {

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index.jsView on unpkg · L86

89 throw new Error("Private key must be a string");

90 }

91 if (!key.startsWith("0x")) {

92 throw new Error("Private key must start with 0x");

93 }

94 if (key.length !== 66) {

95 throw new Error(

96 "Private key must be 66 characters (0x + 64 hexadecimal characters)"

97 );

98 }

99 if (!/^0x[0-9a-fA-F]{64}$/.test(key)) {

100 throw new Error(

101 "Private key must contain only hexadecimal characters (0-9, a-f, A-F)"

102 );

103 }

104}

105function validateApiUrl(url) {

106 let parsed;

Lines 4288-4328javascript

4288 const bytes = new Uint8Array(32);

4289 crypto.getRandomValues(bytes);

4290 return `0x${Array.from(bytes).map((b)

dist/index.cjsView file

Lines 187-227javascript

187 if (temperature === void 0 || temperature === null) {

188 return;

189 }

190 if (typeof temperature !==

package.jsonView file

Lines 1-40json

2 "name": "@blockrun/llm",

3 "version": "3.16.0",

4 "type": "module",

5 "description": "TypeScript SDK for BlockRun - every frontier model behind one OpenAI-compatible client. Pay with a BlockRun API key or per-call in USDC. Smart routing picks the cheapest capable model. No rate limits.",

Source & flagged code

5 flagged · loading source

dist/index.jsView file

86} L87: function validatePrivateKey(key) { L88: if (typeof key !== "string") { ... L113: throw new Error( L114: `Invalid protocol: ${parsed.protocol}. Use http:// or https://` L115: ); ... L184: } L185: const key = options.apiKey ?? (options.privateKey === void 0 && typeof process !== "undefined" ? process.env?.BLOCKRUN_API_KEY : void 0); L186: if (key === void 0) return void 0; ... L242: try { L243: body = await response.json(); L244: } catch {

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index.jsView on unpkg · L86

4308& options.asset.toLowerCase() !== net.usdc.toLowerCase()) { throw new Error( `x402 asset mismatch: the 402 asks for ${options.asset} on ${network}, but this SDK only pays USDC there (${net.usdc})` ); } const domain = net.domain; const signature = await signTypedData({ privateKey, domain, types: TRANSFER_TYPES, primaryType: "TransferWithAuthorization", message: { from: fromAddress, to: recipient, value: BigInt(amount), validAfter: BigInt(validAfter), validBefore: BigInt(validBefore),

Medium

Stripped Provenance Metadata

The ESM payment builder signs a USDC authorization from the caller's wallet to a supplied recipient for a supplied amount.

dist/index.jsView on unpkg · L4308

dist/index.cjsView file

Findings

2 Critical4 Medium6 Low

CriticalWallet Draindist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumStripped Provenance Metadatadist/index.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

Affected versions and remediation

This report applies to @blockrun/llm@3.16.0.

See all versions of @blockrun/llm for other recorded verdicts.

Review the evidence and your use of @blockrun/llm@3.16.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 12:02:23.281Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.