registry / bitfab / 0.28.4

bitfab@0.28.4

Bitfab client for provider-based API calls with local BAML execution

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The SDK explicitly sends requested function/tracing payloads to its configured Bitfab service and can locally invoke its declared BAML peer dependency.

Static reason

No blocking static signals were detected.

Trigger

A consumer constructs and uses `Bitfab`, calls a function, or enables tracing wrappers.

Impact

User-provided API key and explicitly captured execution data are sent to the configured Bitfab service as part of documented SDK behavior.

Mechanism

Explicit API/tracing client with fixed optional peer loading.

Rationale

Source inspection shows a package-aligned SDK client, not stealthy or install-time behavior. Its network, environment, and optional dynamic-import primitives are explicit runtime features with no concrete malicious chain.

Evidence

package.jsondist/index.cjsdist/node.cjsREADME.md

Network endpoints1

bitfab.ai

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

bitfab@0.28.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code