registry / nuvyra-marketplace-sdk / 1.0.6

nuvyra-marketplace-sdk@1.0.6

Node SDK for NuvyraHub on-chain AI model marketplace — list models, acquire licenses, read listings

AI Security Review

scanned 6h ago · by lpm-firewall-ai

No concrete malicious behavior is present in the shipped package source. Installation nevertheless resolves several unexplained runtime dependencies, including a Node built-in-named package and htps-provider.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install resolves the declared runtime dependencies.

Impact

A dependency could introduce its own install-time behavior, but this package's source contains no confirmed payload or exfiltration chain.

Mechanism

Unnecessary dependency installation with suspicious package names.

Rationale

The direct package source has no install-time payload, remote code execution, harvesting, or exfiltration. Unused suspicious dependencies warrant a warning rather than a block because their behavior is not present in the inspected package files.

Evidence

package.jsondist/client.jsdist/index.jsdist/abi.jsdist/types.jsREADME.md

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The manifest declares unused crypto, dotenv, axios, and htps-provider runtime dependencies; crypto shadows a Node built-in and htps-provider has a suspicious name.

nuvyra-marketplace-sdk@1.0.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code