registry / @blockrun/llm / 3.9.0

@blockrun/llm@3.9.0

⚠ Under review

BlockRun SDK - Pay-per-request AI (LLM, Image, Video, Music, Voice) via x402 on Base and Solana

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 424 KB of source, external domains: base.meowrpc.com, base.publicnode.com, basescan.org, blockrun.ai, bridge.base.org, mainnet.base.org, pay.coinbase.com, sol.blockrun.ai, www.coinbase.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-21javascript

1// src/client.ts

2import { privateKeyToAccount } from "viem/accounts";

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index.jsView on unpkg · L1

4// src/types.ts

5var BlockrunError = class extends Error {

6 constructor(message) {

7 super(message);

8 this.name = "BlockrunError";

9 }

10};

11var PaymentError = class extends BlockrunError {

12 constructor(message) {

13 super(message);

14 this.name = "PaymentError";

15 }

16};

17var APIError = class extends BlockrunError {

18 statusCode;

19 response;

20 constructor(message, statusCode, response) {

21 super(message);

dist/index.cjsView file

Lines 127-167javascript

127 this.name = "PaymentError";

128 }

129};

130var APIError = class extends BlockrunError {

131 statusCode;

Source & flagged code

2 flagged · loading source

dist/index.jsView file

1// src/client.ts L2: import { privateKeyToAccount } from "viem/accounts"; L3: ... L34: var SOLANA_USDC_DECIMALS = 6; L35: var DEFAULT_COMPUTE_UNIT_PRICE_MICROLAMPORTS = 1; L36: var DEFAULT_COMPUTE_UNIT_LIMIT = 8e3; ... L128: resource: { L129: url: options.resourceUrl || "https://blockrun.ai/api/v1/chat/completions", L130: description: options.resourceDescription || "BlockRun AI API call", ... L189: transaction.sign([keypair]); L190: return Buffer.from(transaction.serialize()).toString("base64"); L191: };

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code