@yavqo/aisdk: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@yavqo/aisdk: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/client.jsView file

6if (typeof atob !== "undefined") L7: return atob("[redacted]="); L8: // Node fallback — avoid literal for npm page cleanliness

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/client.jsView on unpkg · L6

4const DEFAULT_BASE_URL = (() => { try { if (typeof atob !== "undefined") return atob("[redacted]="); // Node fallback — avoid literal for npm page cleanliness return Buffer.from("[redacted]=", "base64").toString(); } catch { return ["https://", "op", "en", "code", ".ai/zen/v1"].join(""); }

High

Ai Review Evidence

Default API endpoint is deliberately Base64-obscured, with a comment stating it avoids a literal URL for npm-page cleanliness.

dist/client.jsView on unpkg · L4

260async createChatCompletion(opts) { const body = this.buildChatBody(opts, false); const res = await this.request("/chat/completions", { method: "POST", body: JSON.stringify(body), headers: opts.headers, signal: opts.signal, retry: opts.retry, maxRetries: opts.maxRetries, });

High

Ai Review Evidence

On user prompt/chat invocation, the client serializes messages and POSTs them to the concealed default endpoint.

dist/client.jsView on unpkg · L260

dist/cjs/client.jsView file

•matchType = malicious_source_fingerprint_signature signature = 8ac1318bb8448e10 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @yavqo/aisdk@1.0.1 matchedPath = dist/cjs/client.js matchedIdentity = npm:QHlhdnFvL2Fpc2Rr:1.0.1 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cjs/client.jsView on unpkg

dist/models.jsView file

15export const MODELS = { sunlight2: { id: SUNLIGHT_2_ID, displayName: "Sunlight 2", description: "Sunlight 2 — fast, efficient coding model", endpoint: "https://api.yavqo.ai/v1/chat/completions", }, sunlight2Pro: { id: SUNLIGHT_2_PRO_ID, displayName: "Sunlight 2 Pro", description: "Sunlight 2 Pro — frontier reasoning model", endpoint: "https://api.yavqo.ai/v1/chat/completions", },

High

Ai Review Evidence

The default runtime endpoint is opencode.ai, while bundled model metadata and README describe Yavqo/Sunlight endpoints.

dist/models.jsView on unpkg · L15

Source & flagged code

5 flagged

dist/client.jsView file

Lines 1-26javascript

1import { YavqoAPIError, YavqoAuthError, YavqoError } from "./errors.js";

2import { normalizeModelId } from "./models.js";

3import { parseSSE, createTextStream } from "./stream.js";

4const DEFAULT_BASE_URL = (() => {

5 try {

6 if (typeof atob !== "undefined")

7 return atob("aHR0cHM6Ly9vcGVuY29kZS5haS96ZW4vdjE=");

8 // Node fallback — avoid literal for npm page cleanliness

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/client.jsView on unpkg · L6

9 return Buffer.from("aHR0cHM6Ly9vcGVuY29kZS5haS96ZW4vdjE=", "base64").toString();

10 }

11 catch {

12 return ["https://", "op", "en", "code", ".ai/zen/v1"].join("");

13 }

High

Ai Review Evidence

Default API endpoint is deliberately Base64-obscured, with a comment stating it avoids a literal URL for npm-page cleanliness.

dist/client.jsView on unpkg · L4

14})();

15const DEFAULT_TIMEOUT_MS = 60_000;

16const DEFAULT_MAX_RETRIES = 2;

17const DEFAULT_RETRY_CODES = [429, 500, 502, 503, 504, 529];

18const DEFAULT_API_KEY = "sk-qgeusPXxBRNxeblGvbMbFETpNJzZc3MFl7zO6dARiB694CwDvxDhzaXVfhN2Jx1c";

19function resolveApiKey(configApiKey) {

20 if (configApiKey)

21 return configApiKey;

22 if (typeof process !== "undefined" && process.env) {

23 return (process.env.YAVQO_API_KEY ||

24 process.env.SUNLIGHT_API_KEY ||

25 DEFAULT_API_KEY);

26 }

Lines 240-280javascript

240 }

241 catch (abortErr) {

242 throw new YavqoError("Request aborted during retry delay", { cause: abortErr });

243 }

244 continue;

245 }

246 }

247 }

dist/cjs/client.jsView file

•matchType = malicious_source_fingerprint_signature signature = 8ac1318bb8448e10 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @yavqo/aisdk@1.0.1 matchedPath = dist/cjs/client.js matchedIdentity = npm:QHlhdnFvL2Fpc2Rr:1.0.1 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cjs/client.jsView on unpkg

dist/models.jsView file

Lines 1-35javascript

1/**

2 * Model definitions for Yavqo AI SDK

3 * Powered by Sunlight AI

4 */

5export const SUNLIGHT_2_ID = "minimax-m3-free";

6export const SUNLIGHT_2_PRO_ID =