registry / @ljoukov/llm / 7.0.25

@ljoukov/llm@7.0.25

Unified wrapper over OpenAI Responses API and Google Gemini (@google/genai), with streaming + usage/cost metrics.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1007 KB of source, external domains: api.fireworks.ai, api.openai.com, auth.openai.com, chatgpt.com, www.googleapis.com

Source & flagged code

1 flagged

dist/index.jsView file

Lines 701-741javascript

701 }

702 const createdValue = create();

703 store.set(key, createdValue);

704 return createdValue;

705}

706

707// src/utils/env.ts

708var envState = getRuntimeSingleton(/* @__PURE__ */ Symbol.for("@ljoukov/llm.envState"), () => ({

709 envLoaded: false

710}));

711function loadLocalEnv() {

712 if (envState.envLoaded) {

713 return;

714 }

715 const envPath = path.join(process.cwd(), ".env.local");

716 loadEnvFromFile(envPath, { override: false });

717 envState.envLoaded = true;

718}

719function loadEnvFromFile(filePath, { override = false } = {}) {

720 let content;

721 try {

722 content = fs.readFileSync(filePath, "utf8");

723 } catch (error) {

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L721

724 if (error?.code === "ENOENT") {

725 return;

726 }

727 throw error;

728 }

729 for (const line of content.split(/\r?\n/u)) {

730 const entry = parseEnvLine(line);

731 if (!entry) {

732 continue;

733 }

734 const [key, value] = entry;

735 if (override || process.env[key] === void 0) {

736 process.env[key] = value;

737 }

738 }

739}

740function parseEnvLine(line) {

741 const trimmed = line.trim();

Source & flagged code

1 flagged · loading source

dist/index.jsView file

721try { L722: content = fs.readFileSync(filePath, "utf8"); L723: } catch (error) { ... L812: async function [redacted](options) { L813: const base = options.baseUrl.replace(/\/+$/u, ""); L814: const store = options.store?.trim() ? options.store.trim() : "kv"; ... L11521: `You are a delegated subagent at depth ${params.depth}/${params.maxDepth}.`, L11522: "Focus on the delegated task, use available tools when needed, and return concise actionable output.", L11523: "Other agents may share the workspace. Preserve unrelated changes, stay within your assigned write scope, and report files you changed.",

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L721

Findings

2 High3 Medium5 Low

HighChild Process

HighRemote Agent Bridgedist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

1 flagged

dist/index.jsView file

Lines 701-741javascript

701 }

702 const createdValue = create();

703 store.set(key, createdValue);

704 return createdValue;

705}

706

707// src/utils/env.ts

708var envState = getRuntimeSingleton(/* @__PURE__ */ Symbol.for("@ljoukov/llm.envState"), () => ({

709 envLoaded: false

710}));

711function loadLocalEnv() {

712 if (envState.envLoaded) {

713 return;

714 }

715 const envPath = path.join(process.cwd(), ".env.local");

716 loadEnvFromFile(envPath, { override: false });

717 envState.envLoaded = true;

718}

719function loadEnvFromFile(filePath, { override = false } = {}) {

720 let content;

721 try {

722 content = fs.readFileSync(filePath, "utf8");

723 } catch (error) {

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L721

724 if (error?.code === "ENOENT") {

725 return;

726 }

727 throw error;

728 }

729 for (const line of content.split(/\r?\n/u)) {

730 const entry = parseEnvLine(line);

731 if (!entry) {

732 continue;

733 }

734 const [key, value] = entry;

735 if (override || process.env[key] === void 0) {

736 process.env[key] = value;

737 }

738 }

739}

740function parseEnvLine(line) {

741 const trimmed = line.trim();