registry / nuvyra-marketplace-sdk / 1.0.1

nuvyra-marketplace-sdk@1.0.1

Node SDK for NuvyraHub on-chain AI model marketplace — list models, acquire licenses, read listings

AI Security Review

scanned 6h ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package is an ethers-based marketplace client whose network and signing actions require explicit method calls.

Static reason

No blocking static signals were detected.

Trigger

A caller constructs the client and invokes status, listing, or transaction methods.

Impact

Caller-selected RPC requests and intended marketplace transactions may occur; no automatic install, import-time, credential-harvesting, or persistence behavior is present.

Mechanism

Configurable JSON-RPC client and explicit blockchain transaction signing.

Rationale

Source inspection found a conventional SDK with no install hook, hidden execution, filesystem mutation, or exfiltration path. Its environment-variable use configures an explicit blockchain client rather than transmitting collected credentials.

Evidence

package.jsondist/index.jsdist/client.jsREADME.mddist/abi/NuvyraHubMarketplace.json

Network endpoints1

127.0.0.1:8545

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

nuvyra-marketplace-sdk@1.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code