registry / bitfab / 0.29.0

bitfab@0.29.0

Bitfab client for provider-based API calls with local BAML execution

AI Security Review

scanned 8h ago · by lpm-firewall-ai

On explicit `client.call()`, the SDK fetches a function definition and executes returned BAML locally. The fetched BAML is not validated before being supplied to the optional BAML runtime with the configured OpenAI key.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Application code constructs the client and calls `client.call()` with local execution enabled.

Impact

A compromised or untrusted configured service could control local BAML behavior and influence use of the supplied OpenAI credential.

Mechanism

Remote BAML definition executed by a local optional-peer runtime.

Rationale

The package is not proven malicious, but its core local-execution path accepts remote BAML without validation and runs it with a user-provided API key. Downgrade to warn pending trust-boundary review of the configured Bitfab service and BAML runtime behavior.

Evidence

package.jsondist/index.cjsdist/chunk-2M5AWVVQ.jsREADME.md

Network endpoints1

bitfab.ai

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

bitfab@0.29.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code