registry / bitfab / 0.28.6

bitfab@0.28.6

Bitfab client for provider-based API calls with local BAML execution

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The SDK makes package-aligned API requests after explicit client use and can execute fetched BAML prompts through its optional runtime.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit Bitfab client calls, tracing integration, or replay execution

Impact

User-provided inputs and enabled trace payloads may be sent to the configured Bitfab service; no stealthy persistence or foreign control-surface mutation was found.

Mechanism

Configured API client, trace uploader, and optional BAML runtime loader

Rationale

The flagged primitives are documented SDK behavior: explicit function lookup/local BAML execution, opt-in tracing, and an env-gated replay result file. Source inspection found no install-time execution or concrete malicious chain.

Evidence

package.jsonREADME.mddist/index.cjsdist/node.cjs

Network endpoints1

bitfab.ai

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

bitfab@0.28.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code