registry / @mistralai/mistralai / 2.6.4

@mistralai/mistralai@2.6.4

⚠ Under review

TypeScript client library for the Mistral AI API

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2,673 file(s), 5.95 MB of source, external domains: api.eu.mistral.ai, api.mistral.ai, api.us.mistral.ai, arxiv.org, docs.mistral.ai, example.com, hooks.slack.com, json-schema.org, mistral.test, raw.githubusercontent.com, schema.test, www.googleapis.com

Source & flagged code

2 flagged

esm/extra/observability/telemetry.jsView file

Lines 373-413javascript

373 return globalThis

374 .process?.env?.[name];

375 }

376 catch {

377 return undefined;

378 }

379}

380function warnLog(message) {

381 try {

382 globalThis

383 .console?.warn?.(message);

384 }

385 catch {

386 // Ignore logging failures.

387 }

388}

389async function loadModule(specifier) {

390 // Optional OpenTelemetry peer dependencies are loaded lazily at runtime. The

391 // specifier is dynamic, so bundlers cannot (and must not) statically resolve

392 // it — the magic comments keep it as a runtime import for webpack, Turbopack

393 // and Vite instead of failing the build with "Can't resolve <dynamic>".

394 return await import(

395 /* webpackIgnore: true */ /* turbopackIgnore: true */ /* @vite-ignore */ specifier);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

esm/extra/observability/telemetry.jsView on unpkg · L393

396}

397function requireExportConstructor(moduleExports, exportName, moduleName) {

398 const value = moduleExports[exportName];

399 if (typeof value !== "function") {

400 throw new TelemetryConfigurationError(`Mistral telemetry expected ${moduleName} to export ${exportName}.`);

401 }

402 return value;

403}

404function createResource(moduleExports, attributes) {

405 const resourceFromAttributes = moduleExports["resourceFromAttributes"];

406 if (typeof resourceFromAttributes === "function") {

407 return resourceFromAttributes(attributes);

408 }

409 const Resource = moduleExports["Resource"];

410 if (typeof Resource !== "function") {

411 return { attributes };

412 }

413 const resource = new Resource(attributes);

esm/extra/realtime/connection.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

esm/extra/realtime/connection.jsView on unpkg

Source & flagged code

2 flagged · loading source

esm/extra/observability/telemetry.jsView file

393// and Vite instead of failing the build with "Can't resolve <dynamic>". L394: return await import( L395: /* webpackIgnore: true */ /* turbopackIgnore: true */ /* @vite-ignore */ specifier);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

esm/extra/observability/telemetry.jsView on unpkg · L393

esm/extra/realtime/connection.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

esm/extra/realtime/connection.jsView on unpkg

Findings

1 High4 Medium6 Low

HighSemantic Analysis Limitedesm/extra/realtime/connection.js

MediumDynamic Requireesm/extra/observability/telemetry.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to @mistralai/mistralai@2.6.4.

See all versions of @mistralai/mistralai for other recorded verdicts.

Review the evidence and your use of @mistralai/mistralai@2.6.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-20 06:05:33.617Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mistralai

Behavioral surface

Related packages

More from @mistralai

Source & flagged code