registry / @mistralai/mistralai / 3.2.0

@mistralai/mistralai@3.2.0

⚠ Under review

TypeScript client library for the Mistral AI API

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3,559 file(s), 8.05 MB of source, external domains: 127.0.0.1, api.eu.mistral.ai, api.example.test, api.mistral.ai, api.us.mistral.ai, arxiv.org, attacker.example, auth.example.test, docs.mistral.ai, example.com, hooks.slack.com, json-schema.org, mistral.test, raw.githubusercontent.com, s3.us-east-1.amazonaws.com, schema.test, www.googleapis.com

Source & flagged code

2 flagged

esm/extra/workflows/encoding/config.jsView file

Lines 31-71javascript

31 azureStorageAccountUrl: optionalString,

32 bucketId: optionalString,

33 bucketName: optionalString,

34 regionName: optionalString,

35 endpointUrl: optionalString,

36 awsAccessKeyId: optionalString,

37 awsSecretAccessKey: optionalString,

38}).superRefine((config, ctx) => {

39 // Python checks these when it opens the storage; checking them here fails

40 // when the client is configured instead of on the first large payload.

41 const require = (field) => {

42 if (!config[field]) {

43 ctx.addIssue({

44 code: "custom",

45 path: [field],

46 message: `${field} is required for ${config.storageProvider} blob storage`,

47 });

48 }

49 };

50 switch (config.storageProvider) {

51 case StorageProvider.Azure:

52 require("containerName");

53 if (config.azureConnectionString && config.azureStorageAccountUrl) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

esm/extra/workflows/encoding/config.jsView on unpkg · L51

54 ctx.addIssue({

55 code: "custom",

56 path: ["azureConnectionString"],

57 message: "azureConnectionString and azureStorageAccountUrl are mutually exclusive",

58 });

59 }

60 else if (!config.azureConnectionString && !config.azureStorageAccountUrl) {

61 ctx.addIssue({

62 code: "custom",

63 path: ["azureConnectionString"],

64 message: "Either azureConnectionString or azureStorageAccountUrl must be provided",

65 });

66 }

67 break;

68 case StorageProvider.GCS:

69 require("bucketId");

70 break;

71 case StorageProvider.S3:

esm/extra/realtime/connection.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

esm/extra/realtime/connection.jsView on unpkg

Source & flagged code

2 flagged · loading source

esm/extra/workflows/encoding/config.jsView file

51case StorageProvider.Azure: L52: require("containerName"); L53: if (config.azureConnectionString && config.azureStorageAccountUrl) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

esm/extra/workflows/encoding/config.jsView on unpkg · L51

esm/extra/realtime/connection.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

esm/extra/realtime/connection.jsView on unpkg

Findings

1 High4 Medium6 Low

HighSemantic Analysis Limitedesm/extra/realtime/connection.js

MediumDynamic Requireesm/extra/workflows/encoding/config.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to @mistralai/mistralai@3.2.0.

See all versions of @mistralai/mistralai for other recorded verdicts.

Review the evidence and your use of @mistralai/mistralai@3.2.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-23 20:05:22.237Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mistralai

Behavioral surface

Related packages

More from @mistralai

Source & flagged code