No confirmed malicious attack surface. The package is an SDK wrapper that sends caller-provided transcript data only when its methods are invoked.
Static reason
No blocking static signals were detected.
Trigger
Consumer constructs Transcripts and explicitly calls an API method.
Impact
No install-time or import-time side effects; API data handling is expected SDK behavior.
Mechanism
User-invoked API client delegating requests to @or-sdk/base.
Rationale
Source and compiled entrypoint implement a transcript-service client with no autonomous execution or malicious behavior. Network destinations and payloads are caller-configured and method-invoked.
Evidence
package.jsonsrc/Transcripts.tsdist/cjs/Transcripts.jssrc/constants.tssrc/types.tsdist/cjs/index.jsREADME.md