registry / bitfab / 0.28.3

bitfab@0.28.3

Bitfab client for provider-based API calls with local BAML execution

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The SDK performs configured runtime API and tracing requests only after its client/integrations are used.

Static reason

No blocking static signals were detected.

Trigger

Application imports the SDK and invokes Bitfab operations or enabled tracing.

Impact

User-supplied function, tracing, and replay payloads may be sent to the configured Bitfab service; no covert harvesting, persistence, or install-time action was found.

Mechanism

Configured HTTPS API client with optional trace submission.

Rationale

Source inspection shows a package-aligned SDK that makes explicit/configured runtime requests and supports tracing. It has no lifecycle execution or concrete malicious behavior.

Evidence

package.jsonREADME.mddist/index.cjsdist/node.cjsdist/index.jsdist/node.js

Network endpoints1

bitfab.ai

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/index.cjs defines an HTTP client that sends SDK function and tracing payloads to the configured service URL with a Bearer API key.

bitfab@0.28.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code